CVE-2023-34097

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Jun 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-340985.3Shopware is an open source e-commerce software. Due to an incorrect configuration in the `.htaccess` file, the configuration file of the Jav CVE-2023-340995.3Shopware is an open source e-commerce software. The mail validation in the registration process had some flaws, so it was possible to constr CVE-2023-34105.4The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, CVE-2023-341006.5Contiki-NG is an open-source, cross-platform operating system for IoT devices. When reading the TCP MSS option value from an incoming packet CVE-2023-341019.1Contiki-NG is an operating system for internet of things devices. In version 4.8 and prior, when processing ICMP DAO packets in the `dao_inp CVE-2023-341028.8Avo is an open source ruby on rails admin panel creation framework. The polymorphic field type stores the classes to operate on when updatin CVE-2023-341035.4Avo is an open source ruby on rails admin panel creation framework. In affected versions some avo fields are vulnerable to Cross Site Script CVE-2023-341047.5fast-xml-parser is an open source, pure javascript xml parser. fast-xml-parser allows special characters in entity names, which are not esca CVE-2023-341057.5SRS is a real-time video server supporting RTMP, WebRTC, HLS, HTTP-FLV, SRT, MPEG-DASH, and GB28181. Prior to versions 5.0.157, 5.0-b1, and CVE-2023-341066.5GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect r CVE-2023-341076.5GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect CVE-2023-341088.8mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server admin