CVEvulnerability
CVE-2024-23686
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2024-01-19
- Last modified
- 2026-07-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-532
Description
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
Affected configurations
• owasp dependency-check (>= 9.0.0 <= 9.0.5)
• owasp dependency-check (>= 9.0.0 < 9.0.6)
Related
Weakness · CWE (1)
- CWE-532 Insertion of Sensitive Information into Log File weakness
References
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5 Third Party Advisory
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5 Vendor Advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5 Third Party Advisory
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5 Third Party Advisory
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5 Vendor Advisory
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5 Third Party Advisory