CVE-2024-3165 - CVE House
Back to Database
Status published Medium CVE-2024-3165

Database Credential Exposure in the Logs

Vulnerability Description

System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment.   OWASP Top 10 - A05) Insecure Design OWASP Top 10 - A05) Security Misconfiguration OWASP Top 10 - A09) Security Logging and Monitoring Failure

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-3165

Credits & Attribution

No credits recorded in the NVD database.

References

More from dotCMS

View All →
CVE-2025-8311
dotCMS versions 24.03.22 and after, identified a Boolean-based blind SQLi vulnerability...
Critical 9.4
CVE-2025-11165
A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine...
Critical 9.4
CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab...
Critical 9.9
CVE-2024-3938
The "reset password" login page accepted an HTML injection via...
Medium 5.4
CVE-2024-3164
In dotCMS dashboard, the Tools and Log Files tabs under...
Medium 4.5

Affected Vendor

Affected Software

dotCMS core
Vulnerable Versions:
22.02 and after

Timeline

Official Publish: April 1st, 2024
Last Modified: September 30th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-532

MITRE ATT&CK TTPs

T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1555 Credentials from Password Stores
Credential Access
T1078 Valid Accounts
Persistence
T1562 Impair Defenses
Defense Evasion