High severity · published Jun 5, 2023
CVE-2023-34097
Database password exposed in logs in hoppscotch
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HO
hoppscotch · hoppscotch
< 2023.4.5 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-34097
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-34097
Patch
https://github.com/hoppscotch/hoppscotch/commit/15424903ede20b155d764abf4c4f7c2c84c11247
Exploit
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qpx8-wq6q-r833
More from hoppscotch
10.0
CVE-2026-50160
Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite
9.6
CVE-2026-34931
hoppscotch: Improper loopback redirect_uri validation in device-login flow
9.3
CVE-2026-34932
hoppscotch: Stored XSS via mock server responses on backend origin
9.1
CVE-2026-28215
hoppscotch Vulnerable to Unauthenticated Onboarding Config Takeover
8.3
CVE-2026-28216
hoppscotch has IDOR in updateUserEnvironment / deleteUserEnvironment