4.5

CVE-2024-3164

In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance → Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System → Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance.

OWASP Top 10 - A01) Broken Access Control

OWASP Top 10 - A04) Insecure Design
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dotcms ≫ Dotcms Version >= 22.02 < 22.03.15
Dotcms ≫ Dotcms Version >= 23.01 < 23.01.15
Dotcms ≫ Dotcms Version >= 23.02 <= 23.09.7
Dotcms ≫ Dotcms Version23.10.24 Update1 SwEditionlts
Dotcms ≫ Dotcms Version23.10.24 Update2 SwEditionlts
Dotcms ≫ Dotcms Version23.10.24 Update3 SwEditionlts
Dotcms ≫ Dotcms Version23.10.24 Update4 SwEditionlts
Dotcms ≫ Dotcms Version23.10.24 Update5 SwEditionlts
Dotcms ≫ Dotcms Version23.10.24 Update6 SwEditionlts
Dotcms ≫ Dotcms Version23.10.24 Update7 SwEditionlts
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.45
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@dotcms.com 4.5 0.9 3.6
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.