Medium severity · published Jul 25, 2024
CVE-2024-3938
The "reset password" login page accepted an HTML injection via URL parameters
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The "reset password" login page accepted an HTML injection via URL parameters.
This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E
This will result in a view along these lines:
* OWASP Top 10 - A03: Injection
* CVSS Score: 5.4
* AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
* https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
dotCMS core · dotCMS
5.1.5 and after · source: vendor
DO
Dotcms · Dotcms
5.1.5 before 23.01.18; 23.02 through 23.09.7; 23.12.21 through 24.04.23; 24.05.13 before 24.05.31; 23.10.24; 23.10.24; +14 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3938
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3938
Vendor Advisory
https://www.dotcms.com/security/SI-71
More from dotCMS core
10.0
CVE-2026-8054
Unauthenticated SQL Injection in dotCMS Publish Audit API
9.9
CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls
6.1
CVE-2023-3042
CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8
4.5
CVE-2024-3165
Database Credential Exposure in the Logs
4.5
CVE-2024-3164
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and…