What’s Vulnerable › Vulnerabilities

CVE-2024-3165: Database Credential Exposure in the Logs

• Severity: medium (CVSS 4.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-04-01 · updated 2026-06-17
• Weakness: CWE-532

Description

System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.   OWASP Top 10 - A05) Insecure Design OWASP Top 10 - A05) Security Misconfiguration OWASP Top 10 - A09) Security Logging and Monitoring Failure

Affected products

• dotCMS core: from 22.02 before 22.03.15; from 23.01 before 23.01.15; from 23.02 through 23.09.7; 23.10.24-1, 23.10.24-2, 23.10.24-3, 23.10.24-4, 23.10.24-5, 23.10.24-6 (+1) — fixed in 22.03.15, 23.01.15

How to fix

Upgrade to a fixed version: dotCMS core 22.03.15, 23.01.15. Check the vendor advisory for mitigations.

References

• https://github.com/dotCMS/core/issues/27910
• https://github.com/dotCMS/core/pull/28006
• https://www.dotcms.com/security/SI-70
• https://github.com/dotCMS/core/issues/27910
• https://github.com/dotCMS/core/pull/28006
• https://www.dotcms.com/security/SI-70

Get alerted when CVE-2024-3165 or the next vulnerability affects your stack