CVE-2024-3938 Cross-site scripting in dotCMS core
An attacker can inject HTML into the reset password page via URL parameters, potentially leading to cross-site scripting attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-3938?
CVE-2024-3938 is a medium-severity cross-site scripting vulnerability in Dotcms Dotcms, published on 25 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The "reset password" login page accepted an HTML injection via URL parameters.
This has already been rectified via patch, and as such it cannot be demonstrated via Demo site link. Those interested to see the vulnerability may spin up a http://localhost:8082/dotAdmin/#/public/login?resetEmailSent=true&resetEmail=%3Ch1%3E%3Ca%20href%3D%22https:%2F%2Fgoogle.com%22%3ECLICK%20ME%3C%2Fa%3E%3C%2Fh1%3E
This will result in a view along these lines:
* OWASP Top 10 - A03: Injection * CVSS Score: 5.4 * AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator * https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N&... https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
Which versions are affected by CVE-2024-3938?
It affects 1 product.
Products include Dotcms Dotcms.
How do I fix CVE-2024-3938?
No fix has been published for CVE-2024-3938 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-3938 being exploited?
There is no known exploitation of CVE-2024-3938 in the wild and no public exploit code.
Other vulnerabilities in Dotcms Dotcms
Sources
Also known as GHSA-whww-hhj9-9f35.