medium5.3
CVE-2024-23686
Insertion of Sensitive Information into Log File in OWASP DependencyCheck
Impact
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.owasp:dependency-check-ant | >= 9.0.0, < 9.0.6 | 9.0.6 |
| maven | org.owasp:dependency-check-cli | >= 9.0.0, < 9.0.6 | 9.0.6 |
| maven | org.owasp:dependency-check-maven | >= 9.0.0, < 9.0.6 | 9.0.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Owasp | Dependency-Check | from 9.0.0 through 9.0.5 from 9.0.0 before 9.0.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5
- https://github.com/advisories/GHSA-frxm-v7q3-v2wv
- https://nvd.nist.gov/vuln/detail/CVE-2024-23686