Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2024-23686

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

VectorNETWORK

PublishedJan 19, 2024, 22:15

Published Bydisclosure@vulncheck.com

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.owasp:dependency-check-ant(Maven)9.0.09.0.6N/A

org.owasp:dependency-check-cli(Maven)9.0.09.0.6N/A

org.owasp:dependency-check-maven(Maven)9.0.09.0.6N/A

References

https://github.com/advisories/GHSA-qqhq-8r2c-c3f5
https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5
https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5

Weakness Type

CWE-532

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK