Is CVE-2024-3938 actively exploited?

CVE-2024-3938 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2024-3938?

CVE-2024-3938 has a CVSS score of 5.4 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N.

How do I patch CVE-2024-3938?

Patch guidance is available from dotcms security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2024-3938.

CVE-2024-3938 - remediation guidance & executive summary

Q: Which products are affected by CVE-2024-3938?

20 products: dotcms dotcms, dotcms dotcms, dotcms dotcms, dotcms dotcms, dotcms dotcms, and 15 more.

Description

The "reset password" login page accepted an HTML injection via URL parameters. This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E This will result in a view along these lines: * OWASP Top 10 - A03: Injection * CVSS Score: 5.4 * AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Attack Vector: network
Complexity: low
Privileges: none
User Action: required
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: none
Weaknesses: CWE-20 · Improper Input Validation CWE-79 · Cross-site Scripting (XSS)

Metadata

Primary Vendor: DOTCMS
Published: 7/25/2024
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

dotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcmsdotcms : dotcms

Remediation Guidance

Executive Summary

View on NIST NVD