CVE-2023-34097CWE-532

Database password exposed in logs in hoppscotch

High · published June 5, 2023

CVSS v3.1
7.8
EPSS
1%
Percentile
51.8
In the wild
Unconfirmed
What it is

hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00680 · 51.8th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2023-06-05T20:02Z
EPSS history
Timeline
  • 05 JUN 20:02Z
    Database password exposed in logs in hoppscotch
    cvelistv5