CVE-2022-45782: dotCMS

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for password-reset token generation leads to account takeover.

Affected products

• dotCMS dotCMS: from 5.3.8.5, up to and including 5.3.8.15; from 21.03, up to and including 21.10.1

Published 2023-02-01. Last modified 2026-06-17.