CVE-2024-3938: The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated…

PriorityP427medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.24%

14.8th percentile

The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E This will result in a view along these lines: * OWASP Top 10 - A03: Injection * CVSS Score: 5.4 * AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

Affected

8 ranges

Vendor	Product	Version range	Fixed in
dotcms	dotcms	—	—
dotcms	dotcms	—	—
dotcms	dotcms	—	—
dotcms	dotcms	23.02 – 23.09.7	—
dotcms	dotcms	23.12.21 – 24.04.23	—
dotcms	dotcms	>= 24.05.13 < 24.05.31	24.05.31
dotcms	dotcms	>= 5.1.5 < 23.01.18	23.01.18
dotcms	dotcms_core	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.