Description (CNA)
System->Maintenance-> Log Files in dotCMS dashboard is providing the username/password for database connections in the log output. Nevertheless, this is a moderate issue as it requires a backend admin as well as that dbs are locked down by environment. OWASP Top 10 - A05) Insecure Design OWASP Top 10 - A05) Security Misconfiguration OWASP Top 10 - A09) Security Logging and Monitoring Failure
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| dotCMS / dotCMS core | affected 22.02 and after |
CWE
CWE-532
References
- https://www.dotcms.com/security/SI-70
- https://github.com/dotCMS/core/issues/27910
- https://github.com/dotCMS/core/pull/28006
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.