Medium severity · published Apr 1, 2024
CVE-2024-3164
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and…
4.5
CVSS
0.5%
EPSS
No
On KEV
Description
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance → Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System → Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance.
OWASP Top 10 - A01) Broken Access Control
OWASP Top 10 - A04) Insecure Design
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
dotCMS core · dotCMS
22.02 and after · source: vendor
DO
Dotcms · Dotcms
22.02 before 22.03.15; 23.01 before 23.01.15; 23.02 through 23.09.7; 23.10.24; 23.10.24; 23.10.24; +4 more · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3164
Issue Tracking
https://github.com/dotCMS/core/issues/27909
Issue Tracking
https://github.com/dotCMS/core/pull/27912
Broken Link
https://www.dotcms.com/security/SI-69
More from dotCMS core
10.0
CVE-2026-8054
Unauthenticated SQL Injection in dotCMS Publish Audit API
9.9
CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls
6.1
CVE-2024-3938
The "reset password" login page accepted an HTML injection via URL parameters
6.1
CVE-2023-3042
CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8
4.5
CVE-2024-3165
Database Credential Exposure in the Logs