CVE-2023-51840

The cryptographic key is embedded directly in the source code of the DoraCMS application, which means that each instance of the software uses an identical, publicly available or easily readable secret. An attacker, knowing this key, can forge session tokens, sign malicious data, or otherwise bypass authentication and authorization mechanisms. The vulnerability severity (CVSS 9.8) indicates that the attack can be carried out remotely without authentication and without any user interaction.

An attacker can gain full control over the application — read and modify protected data (C:H, I:H) and cause service unavailability (A:H), which corresponds to maximum impact in all three security areas.

Patches available from the vendor should be applied according to the references. It is recommended to update DoraCMS as soon as possible to a version where the cryptographic key is generated individually per instance, and immediately change all keys and secrets in production deployments based on version 2.1.8.

DoraCMS version 2.1.8 (Html-Js DoraCMS)