CVE-2024-3164

Name: CVE-2024-3164
Creator: NVD / NIST
Published: 2024-04-01T22:15:22.507+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.5/10EPSS 0.47%

Last modified Jun 17, 2026

CVE-2024-3164 is a medium-severity vulnerability rated 4.5/10 on the CVSS scale. In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance → Tools portlet. EPSS estimates a 0.47% chance of exploitation in the next 30 days.

Description

In dotCMS dashboard, the Tools and Log Files tabs under System → Maintenance Portlet, which is and always has been an Admin portlet, is accessible to anyone with that portlet and not just to CMS Admins. Users that get site admin but not a system admin, should not have access to the System Maintenance → Tools portlet. This would share database username and password under Log Files and download DB Dump and other dotCMS Content under Tools. Nothing in the System → Maintenance should be displayed for users with site admin role. Only system admins must have access to System Maintenance. OWASP Top 10 - A01) Broken Access Control OWASP Top 10 - A04) Insecure Design

Metrics

CVSS 3.1

4.5/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

EPSS Probability

0.47%

37.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-284

Affected Software

Vendor	Product	Versions	Update
Dotcms	Dotcms	>= 22.02, < 22.03.15	—
Dotcms	Dotcms	>= 23.01, < 23.01.15	—
Dotcms	Dotcms	>= 23.02, <= 23.09.7	—
Dotcms	Dotcms	23.10.24	1

References

https://github.com/dotCMS/core/issues/27909Issue Tracking
https://github.com/dotCMS/core/pull/27912Issue Tracking
https://www.dotcms.com/security/SI-69Broken Link
https://github.com/dotCMS/core/issues/27909Issue Tracking
https://github.com/dotCMS/core/pull/27912Issue Tracking
https://www.dotcms.com/security/SI-69Broken Link

Timeline

Published: Apr 1, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-3164?

How severe is CVE-2024-3164?

CVE-2024-3164 has a CVSS score of 4.5/10 (MEDIUM severity). The EPSS model estimates a 0.47% probability of exploitation in the next 30 days.

How do I fix CVE-2024-3164?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-3164?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST