Database Credential Exposure in the Logs
CVE-2024-3165

4.5MEDIUM

Key Information:

Vendor

Dotcms

Status
Dotcms Core
Vendor
CVE Published:
1 April 2024

What is CVE-2024-3165?

System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.  

OWASP Top 10 - A05) Insecure Design

OWASP Top 10 - A05) Security Misconfiguration

OWASP Top 10 - A09) Security Logging and Monitoring Failure

Affected Version(s)

dotCMS core 22.02 and after

References

https://www.dotcms.com/security/SI-70
https://github.com/dotCMS/core/issues/27910
https://github.com/dotCMS/core/pull/28006

CVSS V3.1

Score:
4.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.