Security readout for executives and security teams
Plain-English summary
A reported flaw in dotCMS 20.11's admin template function could let malicious script be saved and later run in a user's browser. If session cookies are exposed, an attacker may gain privileged access. The provided sources do not show active exploitation or a confirmed vendor fix.
Executive priority
Treat as a targeted web administration risk, not a confirmed mass-exploitation emergency. Prioritize if dotCMS 20.11 is internet-accessible, used by multiple administrators, or supports business-critical sites.
Technical view
CVE-2020-35274 describes stored cross-site scripting in the dotCMS Add Template/admin panel in version 20.11. The CVE text says this can compromise a site or web application by stealing cookies and gaining remote privileges. No CVSS, CWE, CPE, or patch details are provided.
Likely exposure
Exposure appears limited to organizations running dotCMS 20.11 and using the affected Add Template/admin panel workflow. The source bundle does not identify specific CPEs, hosting models, or whether other dotCMS versions are affected.
Exploitation context
The CVE includes an Exploit-DB reference, indicating public exploit information exists. However, the bundle marks KEV as false and provides no cited evidence of active exploitation in the wild.
Researcher notes
Evidence is thin: the CVE record names dotCMS 20.11 and stored XSS impact, but lacks CVSS, CWE, affected CPEs, and remediation data. Avoid broad version claims without vendor confirmation.
Mitigation direction
- Check dotCMS vendor guidance for fixed versions or recommended mitigations.
- Restrict admin panel access to trusted networks and users.
- Review session cookie protections and administrative session lifetimes.
- Apply least privilege to template management roles.
- Monitor admin template changes for unexpected script content.
Validation and detection
- Inventory dotCMS deployments and confirm exact running versions.
- Determine whether version 20.11 is present in production or staging.
- Review admin template records for unexpected JavaScript or HTML injection.
- Check access logs for unusual template edits or admin session reuse.
- Verify vendor advisories before declaring remediation complete.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-35274 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exploit-db.com/exploits/49168CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.