dotCMS 24.04.24v3 LTS
Approved changes feed: RSS · Atom
cpe:2.3:a:dotcms:dotcms:24.04.24:3:*:*:lts:*:*:*
part: a version: 24.04.24 update: 3
| Vendor | Dotcms (f87a28fd-603b-5a54-bf85-9747cd18195f) |
|---|---|
| Product | Dotcms (93150035-5aef-51ee-a96c-c57b0367f6d2) |
| Edition | * |
| Language | * |
| Software edition | lts |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/dotcms/core |
purl2cpe | 2026-06-01 10:16:07.227302 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-3938 |
vulnerable | 2026-06-08 06:43:51.940373 |
Details available
MEDIUM (5.4)
The "reset password" login page accepted an HTML injection via URL parameters.
This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E
This will result in a view along these lines:
* OWASP Top 10 - A03: Injection
* CVSS Score: 5.4
* AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
* https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
Published: 2024-07-25T21:17:49.359Z
Updated: 2024-08-01T20:26:57.098Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.