Using an arbitrary URL redirect a attacker is able to send visiting clients to a web site of the attacker’s choosing. To successfully mount such a attack the attacker prepares a link to the dotCMS site that looks like a innocent link to an article. If the victim visits the link the browser gets redirected to the attacker’s controlled page.

As a workaround, we suggest using a Application firewall to block access to those urls externally.