CVE-2024-23686
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
9.0.0 <= 9.0.6 | affected | ||
9.0.0 <= 9.0.5 | affected | ||
9.0.0 <= 9.0.5 | affected |
Weaknesses
- CWE-532: CWE-532 Insertion of Sensitive Information into Log File
ADP Enrichment
CVE Program Container
Additional References
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: partial
References
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.