CVE-2023-34097: fallo de gravedad alta en hoppscotch
Database password exposed in logs in hoppscotch
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.8epss 0.7%
hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
hoppscotch · hoppscotchCVEs relacionadas — hoppscotch
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-50160CRITICALMass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET OverwriteEPSS 1.7%CVE-2026-59721HIGHHoppscotch: Admin RCE via MAILER_SMTP_URL nodemailer sendmail-transport injectionEPSS 1.0%CVE-2024-34347HIGH@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCEEPSS 0.6%CVE-2024-27092MEDIUMContent spoofing - real Hoppscotch emailsEPSS 0.6%CVE-2026-59720HIGHHoppscotch: Insecure Default Configuration Allows Public Exposure of Private Collection Data via Mock ServerEPSS 0.6%CVE-2026-28215CRITICALhoppscotch Vulnerable to Unauthenticated Onboarding Config TakeoverEPSS 0.6%