{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3164", "assignerOrgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "state": "PUBLISHED", "assignerShortName": "dotCMS", "dateReserved": "2024-04-01T21:21:28.290Z", "datePublished": "2024-04-01T21:27:51.580Z", "dateUpdated": "2024-07-05T17:21:23.824Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "dotCMS core", "vendor": "dotCMS", "versions": [{"status": "affected", "version": "22.02 and after"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<b><p><span style=\"background-color: transparent;\">In dotCMS dashboard, the Tools and Log Files tabs under System \u2192 Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance \u2192 Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System \u2192 Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance.</span></p><p><span style=\"background-color: transparent;\">OWASP Top 10 - A01) Broken Access Control</span></p><p><span style=\"background-color: transparent;\">OWASP Top 10 - A04) Insecure Design</span></p></b>"}], "value": "In dotCMS dashboard, the Tools and Log Files tabs under System \u2192 Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance \u2192 Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System \u2192 Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance.\n\nOWASP Top 10 - A01) Broken Access Control\n\nOWASP Top 10 - A04) Insecure Design\n\n"}], "impacts": [{"capecId": "CAPEC-131", "descriptions": [{"lang": "en", "value": "CAPEC-131 Resource Leak Exposure"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-552", "description": "CWE-552 Files or Directories Accessible to External Parties", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "5b9d93f2-25c7-46b4-ab60-d201718c9dd8", "shortName": "dotCMS", "dateUpdated": "2024-04-01T21:31:26.442Z"}, "references": [{"url": "https://auth.dotcms.com/security/SI-69?token=dc1f0241-b697-41dd-8140-154658e90c54"}, {"url": "https://github.com/dotCMS/core/pull/27912"}, {"url": "https://github.com/dotCMS/core/issues/27909"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3164", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-02T19:40:20.151042Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-05T17:21:23.824Z"}}]}}

{"descriptions": [{"lang": "en", "value": "In dotCMS dashboard, the Tools and Log Files tabs under System \u2192 Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance \u2192 Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System \u2192 Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance.\n\nOWASP Top 10 - A01) Broken Access Control\n\nOWASP Top 10 - A04) Insecure Design\n\n"}, {"lang": "es", "value": "En el panel de dotCMS, las pesta\u00f1as Tools y Log Files en System-&gt;Maintenance-&gt; Log Files, que es y siempre ha sido un portlet de administraci\u00f3n, son accesibles para cualquier persona con ese portlet y no solo para los administradores de CMS. Los usuarios que obtienen un administrador del sitio pero no un administrador del sistema no deber\u00edan tener acceso al portlet System Maintenance ? Tools. Esto compartir\u00eda el nombre de usuario y la contrase\u00f1a de la base de datos en Archivos de registro y descargar\u00eda DB Dump y otro contenido de dotCMS en Herramientas. No se debe mostrar nada en System ? Maintenance para los usuarios con funci\u00f3n de administrador del sitio. S\u00f3lo los administradores del sistema deben tener acceso al Mantenimiento del sistema. OWASP Top 10 - A01) Control de acceso roto OWASP Top 10 - A04) Dise\u00f1o inseguro"}], "id": "CVE-2024-3164", "lastModified": "2024-04-11T01:25:55.603", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 3.6, "source": "security@dotcms.com", "type": "Secondary"}]}, "published": "2024-04-01T22:15:22.507", "references": [{"source": "security@dotcms.com", "url": "https://auth.dotcms.com/security/SI-69?token=dc1f0241-b697-41dd-8140-154658e90c54"}, {"source": "security@dotcms.com", "url": "https://github.com/dotCMS/core/issues/27909"}, {"source": "security@dotcms.com", "url": "https://github.com/dotCMS/core/pull/27912"}], "sourceIdentifier": "security@dotcms.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-552"}], "source": "security@dotcms.com", "type": "Secondary"}]}

{}