← Vulnerability feed

Vulnerability record · CVE-2023-34097 · published 5 June 2023

CVE-2023-34097: Hoppscotch sensitive information in log file vulnerability

Hoppscotch · Hoppscotch

hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.

8.8 CVSS 3.1 High EPSS 0.68% · top 49.5% CWE-532 · Sensitive information in log file
8.8CVSS 3.1 base score
0.68%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with full access to the database. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/hoppscotch/hoppscotch/commit/15424903ede20b155d764abf4c4f7c2c84c11247 Patch
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qpx8-wq6q-r833 ExploitVendor Advisory
https://github.com/hoppscotch/hoppscotch/commit/15424903ede20b155d764abf4c4f7c2c84c11247 Patch
https://github.com/hoppscotch/hoppscotch/security/advisories/GHSA-qpx8-wq6q-r833 ExploitVendor Advisory

Track CVE-2023-34097 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-50160Hoppscotch mass assignment vulnerabilityHoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated P…EPSS 1.7%9.1CVE-2026-28215Hoppscotch improper access control vulnerabilityhoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, an unauthenticated attacker can overwrite the entire infrastructur…EPSS 0.66%8.5CVE-2026-34931Hoppscotch open redirect vulnerabilityhoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfilt…EPSS 0.43%8.5CVE-2026-34932Hoppscotch cross-site scripting vulnerabilityhoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRF. This is…EPSS 0.40%8.3CVE-2026-28216Hoppscotch insecure direct object reference vulnerabilityhoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's perso…EPSS 0.42%8.0CVE-2022-0121Hoppscotch cross-site scripting vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue aff…EPSS 1.2%6.5CVE-2026-30825Hoppscotch insecure direct object reference vulnerabilityhoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authentica…EPSS 0.27%6.5CVE-2026-28217Hoppscotch missing authorization vulnerabilityhoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection…EPSS 0.38%

Source: NIST National Vulnerability Database (record CVE-2023-34097), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.