CVE-2024-3164

    Dashboard / Vulnerabilities / CVE-2024-3164

    CVE-2024-3164

    Published: 1 Apr 2024Last Modified: 12 Aug 2026

    Summary:

    Details: In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance → Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System → Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance. OWASP Top 10 - A01) Broken Access Control OWASP Top 10 - A04) Insecure Design

    References: https://www.dotcms.com/security/SI-69, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3164.json, https://nvd.nist.gov/vuln/detail/CVE-2024-3164, https://github.com/dotCMS/core/issues/27909, https://github.com/dotCMS/core/pull/27912

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a7dc7c4140d33d98ccc65120f9d659d07ad42ce0
    Fixed -cc51d80d4145ee517c981a5e9b7b5399ca3dfca3

    Affected versions

    22.02 and after

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-3164 | CVE-DB