CVEvulnerability

CVE-2024-3165

4.5 MEDIUM Published 2024-04-01 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2024-04-01
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-532

Description

System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.   OWASP Top 10 - A05) Insecure Design OWASP Top 10 - A05) Security Misconfiguration OWASP Top 10 - A09) Security Logging and Monitoring Failure

Affected configurations

• dotcms dotcms (>= 22.02 < 22.03.15) • dotcms dotcms (>= 23.01 < 23.01.15) • dotcms dotcms (>= 23.02 <= 23.09.7) • dotcms dotcms 23.10.24

Related

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References