CVE-2020-27848: 
dotCMS vulnerability analysis and mitigation

CVE-2020-27848 affects dotCMS versions before 20.10.1, allowing SQL injection through the /api/v1/containers orderby parameter. The vulnerability was discovered in October 2020 and requires an authenticated manager in the dotCMS system to exploit (NVD).

The vulnerability exists in the PaginatorOrdered classes used to paginate REST endpoint results. These classes fail to properly sanitize the orderBy parameter, making it vulnerable to SQL injection attacks. The CVSS v3.1 base score is 8.8 (HIGH) with vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

If exploited, the vulnerability allows attackers to execute arbitrary SQL commands in the context of the application database. This could lead to unauthorized access to data, modification of database contents, and potential exposure of sensitive information (GitHub Issue).

The vulnerability has been demonstrated to be exploitable using tools like sqlmap. Proof-of-concept exploits show that attackers can use time-based SQL injection techniques by manipulating the orderby parameter. However, exploitation requires authentication as a manager in the dotCMS system (GitHub Issue).

The vulnerability was patched in dotCMS version 20.10.1. Organizations should upgrade to this version or later to protect against this vulnerability. The fix involves proper sanitization of the orderBy parameter in the PaginatorOrdered classes (GitHub Patch).