CVE-2023-34097
Assigner: GitHub_M
Published: 2023-06-05T20:02:04.497Z
State: PUBLISHED
title: Database password exposed in logs in hoppscotch
problemTypes: descriptions: cweId: CWE-532
description: CWE-532: Insertion of Sensitive Information into Log File
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
affected: vendor: hoppscotch
product: hoppscotch
versions: version: < 2023.4.5
status: affected
descriptions: value: hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability. 
source: advisory: GHSA-qpx8-wq6q-r833
discovery: UNKNOWN