CVE-2024-23686 DependencyCheck Debug Mode Logging of NVD API Key

2024-01-1921:12:13

CWE-532

VulnCheck

www.cve.org

cve-2024-23686

dependencycheck

debug mode

logging

nvd api key

maven 9.0.0

cli 9.0.0

ant 9.0.0

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

CNA Affected

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.owasp:dependency-check-maven",
    "versions": [
      {
        "lessThanOrEqual": "9.0.6",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "maven"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.owasp:dependency-check-cli",
    "versions": [
      {
        "lessThanOrEqual": "9.0.5",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "maven"
      }
    ]
  },
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.owasp:dependency-check-ant",
    "versions": [
      {
        "lessThanOrEqual": "9.0.5",
        "status": "affected",
        "version": "9.0.0",
        "versionType": "maven"
      }
    ]
  }
]