CVE-2023-3042

In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.jsp , which should return a 404 response but didn't. The oversight in the default invalid URL character list can be viewed at the provided GitHub link https://github.com/dotCMS/core/blob/master/dotCMS/src/main/java/com/dotcms/filters/NormalizationFilter.java#L37 .  To mitigate, users can block URLs with double slashes at firewalls or utilize dotCMS config variables. Specifically, they can use the DOT_URI_NORMALIZATION_FORBIDDEN_STRINGS environmental variable to add // to the list of invalid strings. Additionally, the DOT_URI_NORMALIZATION_FORBIDDEN_REGEX variable offers more detailed control, for instance, to block //html.* URLs. Fix Version:23.06+, LTS 22.03.7+, LTS 23.01.4+

• CWE-79
• CWE-79

• https://www.dotcms.com/security/SI-68Vendor Advisory
• https://www.dotcms.com/security/SI-68Vendor Advisory

Published

Oct 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30408Jerryscript commit 1a2c047 was discovered to contain a segme…5.5
• CVE-2023-3041The Autochat Automatic Conversation WordPress plugin through…6.1
• CVE-2023-30410Jerryscript commit 1a2c047 was discovered to contain a stack…5.5
• CVE-2023-30414Jerryscript commit 1a2c047 was discovered to contain a stack…5.5
• CVE-2023-30415Sourcecodester Packers and Movers Management System v1.0 was…9.8
• CVE-2023-30417A cross-site scripting (XSS) vulnerability in Pear-Admin-Boo…5.4
• CVE-2023-30421mystrtod in mjson 1.2.7 requires more than a billion iterati…2.9
• CVE-2023-30428Incorrect Authorization vulnerability in Apache Software Fou…8.1
• CVE-2023-30429Incorrect Authorization vulnerability in Apache Software Fou…8.8
• CVE-2023-3043 AMI’s SPx contains a vulnerability in the BMC where…8.8
• CVE-2023-30430IBM Security Verify Access 10.0.0 through 10.0.7.1 could all…5.5
• CVE-2023-30431IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Se…7.8