Unrated severityNVD Advisory· Published Apr 2, 2014· Updated May 6, 2026
CVE-2013-3484
CVE-2013-3484
Description
Multiple cross-site scripting (XSS) vulnerabilities in dotCMS before 2.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) _loginUserName parameter to application/login/login.html, (2) my_account_login parameter to c/portal_public/login, or (3) email parameter to forgotPassword.
Affected products
9cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*range: <=2.3.1
- cpe:2.3:a:dotcms:dotcms:1.9.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:dotcms:dotcms:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:dotcms:dotcms:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:dotcms:dotcms:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:dotcms:dotcms:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:dotcms:dotcms:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:dotcms:dotcms:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:dotcms:dotcms:2.3:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- dotcms.com/security/SI-14nvdExploitVendor Advisory
- secunia.com/advisories/53265nvdVendor Advisory
- github.com/dotCMS/dotCMS/issues/2949nvd
News mentions
0No linked articles in our index yet.