{"cve":"CVE-2024-47182","nvd":{"published":"2024-09-27T14:15:04.620","modified":"2026-06-17T07:56:41.283","status":"Analyzed","description":"Dozzle is a realtime log viewer for docker containers. Before version 8.5.3, the app uses sha-256 as the hash for passwords, which leaves users susceptible to rainbow table attacks. The app switches to bcrypt, a more appropriate hash for passwords, in version 8.5.3.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-326","CWE-328"],"references":["https://github.com/amir20/dozzle/commit/de79f03aa3dbe5bb1e154a7e8d3dccbd229f3ea3","https://github.com/amir20/dozzle/security/advisories/GHSA-w7qr-q9fh-fj35"],"products":["amirraminfar:dozzle"],"source":"nvd","synced_at":"2026-10-19T21:55:31.737901711+00:00"},"epss":{"cve":"CVE-2024-47182","score":0.00208,"percentile":0.10945,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-w7qr-q9fh-fj35","url":"https://osv.dev/vulnerability/GHSA-w7qr-q9fh-fj35","summary":"Dozzle uses unsafe hash for passwords","modified":"2024-10-09T21:46:22Z","packages":[{"ecosystem":"Go","name":"github.com/amir20/dozzle","purl":"pkg:golang/github.com/amir20/dozzle","ranges":["<8.5.3"],"fixed":["8.5.3"]}]},{"id":"GO-2024-3163","url":"https://osv.dev/vulnerability/GO-2024-3163","summary":"Dozzle uses unsafe hash for passwords in github.com/amir20/dozzle","modified":"2024-10-09T20:59:08.152131Z","packages":[{"ecosystem":"Go","name":"github.com/amir20/dozzle","purl":"pkg:golang/github.com/amir20/dozzle","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}