Lucene search

K
ubuntucveUbuntu.comUB:CVE-2023-44483
HistoryOct 20, 2023 - 12:00 a.m.

CVE-2023-44483

2023-10-2000:00:00
ubuntu.com
ubuntu.com
21
cve-2023-44483
apache santuario
xml security
java
vulnerability
log files disclosure
upgrade
jsr 105 api

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

38.8%

All versions of Apache Santuario - XML Security for Java prior to 2.2.6,
2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue
where a private key may be disclosed in log files when generating an XML
Signature and logging with debug level is enabled. Users are recommended to
upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

38.8%