CVE-2024-23686

Published Jan 19, 2024

Last updated 10 months ago

Overview

Description: DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
Source: disclosure@vulncheck.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.3
Impact score: 1.4
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity: MEDIUM

Weaknesses

nvd@nist.gov: CWE-532
disclosure@vulncheck.com: CWE-532

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:owasp:dependency-check:*:*:*:*:*:ant:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4B46B595-71B8-4A55-884B-333B36B60773",
            "versionEndIncluding": "9.0.5",
            "versionStartIncluding": "9.0.0"
          },
          {
            "criteria": "cpe:2.3:a:owasp:dependency-check:*:*:*:*:*:cli:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CB4D8662-BC31-4105-9B5A-A64C482A880E",
            "versionEndIncluding": "9.0.5",
            "versionStartIncluding": "9.0.0"
          },
          {
            "criteria": "cpe:2.3:a:owasp:dependency-check:*:*:*:*:*:maven:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BF9CA0F5-E249-4577-BEAD-54CE438914AD",
            "versionEndExcluding": "9.0.6",
            "versionStartIncluding": "9.0.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

Weaknesses

Configurations

References