CWE Code: 200
Vulnerability Type: sql_injection
CVSS Score: 4.0
CWE Name:  Information Exposure
Summary: sql injection vulnerability in dotcms before 3.5 allows remote administrators to execute arbitrary sql commands via the c0-e3 parameter to dwr/call/plaincall/userajax.getuserslist.dwr.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/NONE
Published Date: 2016-04-19
Last Modified Date: 2016-04-28