Lucene search

DotCMSCVE-2024-3165

HistoryApr 01, 2024 - 10:15 p.m.

CVE-2024-3165

2024-04-0122:15:23

CWE-522

dotCMS

web.nvd.nist.gov

dotcms

log files

database connections

moderate issue

backend admin

locked down databases

insecure design

security misconfiguration

security logging.

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

Percentile

15.5%

JSON

System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.

OWASP Top 10 - A05) Insecure Design

OWASP Top 10 - A05) Security Misconfiguration

OWASP Top 10 - A09) Security Logging and Monitoring Failure

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "dotCMS core",
    "vendor": "dotCMS",
    "versions": [
      {
        "status": "affected",
        "version": "22.02 and after"
      }
    ]
  }
]

References

github.com/dotCMS/core/issues/27910

github.com/dotCMS/core/pull/28006

www.dotcms.com/security/SI-70

CVSS3

4.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

AI Score

4.7

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for CVE-2024-3165