CVE-2024-3165
published 2024-04-01CVE-2024-3165: System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a…
PriorityP421medium4.5CVSS 3.1
AVNACLPRHUIRSUCHINAN
EPSS
0.50%
38.7th percentile
System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.
OWASP Top 10 - A05) Insecure Design
OWASP Top 10 - A05) Security Misconfiguration
OWASP Top 10 - A09) Security Logging and Monitoring Failure
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dotcms | dotcms | — | — |
| dotcms | dotcms | >= 22.02 < 22.03.15 | 22.03.15 |
| dotcms | dotcms | >= 23.01 < 23.01.15 | 23.01.15 |
| dotcms | dotcms | 23.02 – 23.09.7 | — |
| dotcms | dotcms_core | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
2024-04-01
Published