Lucene search

GoogleOSV:GHSA-FRXM-V7Q3-V2WV

HistoryJan 20, 2024 - 12:30 a.m.

Insertion of Sensitive Information into Log File in OWASP DependencyCheck

2024-01-2000:30:27

Google

osv.dev

owasp

dependencycheck

sensitive information

log file

maven

cli

ant

debug mode

nvd api key

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

CPENameOperatorVersion
org.owasp:dependency-check-maveneq9.0.3
org.owasp:dependency-check-clieq9.0.1
org.owasp:dependency-check-maveneq9.0.1
org.owasp:dependency-check-anteq9.0.5
org.owasp:dependency-check-maveneq9.0.4
org.owasp:dependency-check-clieq9.0.2
org.owasp:dependency-check-clieq9.0.3
org.owasp:dependency-check-clieq9.0.4
org.owasp:dependency-check-maveneq9.0.0
org.owasp:dependency-check-maveneq9.0.5

Name	Operator	Version
org.owasp:dependency-check-maven	eq	9.0.3
org.owasp:dependency-check-cli	eq	9.0.1
org.owasp:dependency-check-maven	eq	9.0.1
org.owasp:dependency-check-ant	eq	9.0.5
org.owasp:dependency-check-maven	eq	9.0.4
org.owasp:dependency-check-cli	eq	9.0.2
org.owasp:dependency-check-cli	eq	9.0.3
org.owasp:dependency-check-cli	eq	9.0.4
org.owasp:dependency-check-maven	eq	9.0.0
org.owasp:dependency-check-maven	eq	9.0.5

Rows per page:

1-10 of 181

References

github.com/advisories/GHSA-qqhq-8r2c-c3f5

github.com/jeremylong/DependencyCheck

github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5

nvd.nist.gov/vuln/detail/CVE-2024-23686

vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

20.8%

JSON

Related for OSV:GHSA-FRXM-V7Q3-V2WV