Medium severity · published Apr 1, 2024
CVE-2024-3164
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and…
4.5
CVSS
0.5%
EPSS
No
On KEV
Description
In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance → Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System → Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance.
OWASP Top 10 - A01) Broken Access Control
OWASP Top 10 - A04) Insecure Design
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DO
Dotcms · Dotcms
22.02 before 22.03.15; 23.01 before 23.01.15; 23.02 through 23.09.7; 23.10.24; 23.10.24; 23.10.24; +4 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3164
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3164
Issue Tracking
https://github.com/dotCMS/core/issues/27909
Issue Tracking
https://github.com/dotCMS/core/pull/27912
Broken Link
https://www.dotcms.com/security/SI-69
More from Dotcms
9.8
CVE-2022-26352
dotCMS Unrestricted Upload of File Vulnerability
9.9
CVE-2025-11165
A sandbox escape vulnerability exists in dotCMS’s Velocity scripting engine (VTools) that allows authenticated users with scripting privileges to bypass class and package…
9.8
CVE-2020-19138
Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component…
9.8
CVE-2020-6754
dotCMS before 5.2.4 is vulnerable to directory traversal, leading to incorrect access control
9.8
CVE-2017-5344
An issue was discovered in dotCMS through 3.6.1