CVE-2024-3165

    Dashboard / Vulnerabilities / CVE-2024-3165

    CVE-2024-3165

    Published: 1 Apr 2024Last Modified: 12 Aug 2026

    Summary: Database Credential Exposure in the Logs

    Details: System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.   OWASP Top 10 - A05) Insecure Design OWASP Top 10 - A05) Security Misconfiguration OWASP Top 10 - A09) Security Logging and Monitoring Failure

    References: https://www.dotcms.com/security/SI-70, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3165.json, https://nvd.nist.gov/vuln/detail/CVE-2024-3165, https://github.com/dotCMS/core/issues/27910, https://github.com/dotCMS/core/pull/28006

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a7dc7c4140d33d98ccc65120f9d659d07ad42ce0
    Fixed -cc51d80d4145ee517c981a5e9b7b5399ca3dfca3

    Affected versions

    22.02 and after

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-3165 | CVE-DB