Lucene search

DotCMSCVELIST:CVE-2024-3165

HistoryApr 01, 2024 - 9:38 p.m.

CVE-2024-3165 Database Credential Exposure in the Logs

2024-04-0121:38:04

CWE-522

dotCMS

www.cve.org

cve-2024-3165

database

credential

exposure

logs

maintenance

dotcms

dashboard

username

password

connections

moderate

backend admin

environment

owasp top 10

insecure design

security misconfiguration

logging

monitoring failure

4.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.

OWASP Top 10 - A05) Insecure Design

OWASP Top 10 - A05) Security Misconfiguration

OWASP Top 10 - A09) Security Logging and Monitoring Failure

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "dotCMS core",
    "vendor": "dotCMS",
    "versions": [
      {
        "status": "affected",
        "version": "22.02 and after"
      }
    ]
  }
]

References

auth.dotcms.com/security/SI-70?token=563ec927-3190-4478-bd77-0d6f8c6fc676

github.com/dotCMS/core/issues/27910

github.com/dotCMS/core/pull/28006

4.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

5.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Related for CVELIST:CVE-2024-3165