CVE-2024-47182 Dozzle uses unsafe hash for passwords
Dozzle uses weak SHA-256 hashing for passwords, allowing attackers to potentially recover credentials via rainbow table attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-47182?
CVE-2024-47182 is a medium-severity vulnerability in amir20 dozzle, published on 27 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.
Which versions are affected by CVE-2024-47182?
3 open source packages ship an affected version, including github.com/amir20/dozzle. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/amir20/dozzle Go | All versions | None |
github.com/amir20/dozzle Go | All versions | 8.5.3 |
github.com/amir20/dozzle Go | All versions | 8.5.3 |
Products include Amirraminfar Dozzle.
How do I fix CVE-2024-47182?
Upgrade github.com/amir20/dozzle to 8.5.3 or later.
Is CVE-2024-47182 being exploited?
There is no known exploitation of CVE-2024-47182 in the wild and no public exploit code.
Other vulnerabilities in amir20 dozzle
- CVE-2026-44985 Dozzle: Cross-Site WebSocket Hijacking (CSWSH) on exec/attach endpoints bypasses authentication
- CVE-2026-24740 Dozzle Agent Label-Based Access Control Bypass Allows Unauthorized Container Shell Access
- CVE-2026-45298 Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)
Sources
Also known as GHSA-w7qr-q9fh-fj35, GO-2024-3163.