CVE-2022-24875CWE-532

Potential Secrets being logged to disk in CVEProject/cve-services

Medium · published April 21, 2022

CVSS v3.1
5.3
EPSS
1%
Percentile
61.9
In the wild
Unconfirmed
What it is

The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00980 · 61.9th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2022-04-21T17:20Z
EPSS history
Timeline
  • 21 APR 17:20Z
    Potential Secrets being logged to disk in CVEProject/cve-services
    cvelistv5