Insertion of Sensitive Information into Log File in OWASP DependencyCheck
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-23686US | medium5.3 | — | ||
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Ke… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5ADVISORY
- https://github.com/jeremylong/DependencyCheckPACKAGE
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-23686ADVISORY
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan