CVE-2024-3165

MEDIUM EPSS 38.7%
Published Apr 1, 20242y ago · Modified Jun 17, 20261w ago
4.5 CVSS 3.1
Medium
Find Similar
Published Apr 1, 2024 2y ago
Last Modified Jun 17, 2026 1w ago

Description

System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.   OWASP Top 10 - A05) Insecure Design OWASP Top 10 - A05) Security Misconfiguration OWASP Top 10 - A09) Security Logging and Monitoring Failure

CVSS Details

Base Score
4.5
Exploitability
0.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
38.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-532

Affected Products 10

VendorProductVersionRange
dotcmsdotcms*≥22.02  –  <22.03.15
dotcmsdotcms*≥23.01  –  <23.01.15
dotcmsdotcms*≥23.02  –  ≤23.09.7
dotcmsdotcms23.10.24any
dotcmsdotcms23.10.24any
dotcmsdotcms23.10.24any
dotcmsdotcms23.10.24any
dotcmsdotcms23.10.24any
dotcmsdotcms23.10.24any
dotcmsdotcms23.10.24any

References 3

  • github.com https://github.com/dotCMS/core/issues/27910
    Issue Tracking
  • github.com https://github.com/dotCMS/core/pull/28006
    Issue Tracking
  • dotcms.com https://www.dotcms.com/security/SI-70
    Broken Link

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.