Vulnerability · Published Jun 5, 2023 · Assigned by GitHub_M
CVE-2023-34097Database password exposed in logs in hoppscotch
High 7.8
In plain English
A high-severity sensitive data in logs in hoppscotch from hoppscotch. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.7%top 47.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hoppscotch | hoppscotch | < 2023.4.5 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H