VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Jul 25, 2024· Updated Jun 17, 2026

CVE-2024-3938

CVE-2024-3938

Description

The "reset password" login page accepted an HTML injection via URL parameters.

This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E

This will result in a view along these lines:

  • OWASP Top 10 - A03: Injection
  • CVSS Score: 5.4
  • AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
  • https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

Affected products

19
  • Dotcms/Dotcms19 versions
    cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*+ 18 more
    • cpe:2.3:a:dotcms:dotcms:*:*:*:*:*:*:*:*range: >=5.1.5,<23.01.18
    • cpe:2.3:a:dotcms:dotcms:23.10.24.0:*:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:10:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:1:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:2:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:3:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:4:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:5:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:6:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:7:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:8:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:23.10.24:9:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:24.04.24:-:*:*:*:*:*:*
    • cpe:2.3:a:dotcms:dotcms:24.04.24:0:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:24.04.24:1:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:24.04.24:2:*:*:lts:*:*:*
    • cpe:2.3:a:dotcms:dotcms:24.04.24:3:*:*:lts:*:*:*
    • (no CPE)
    • (no CPE)range: 5.1.5 and after

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.