CVE-2023-51390CWE-215CWE-284

Information Disclosure Vulnerability in Journalpump

Medium · published December 20, 2023

CVSS v3.1
6.5
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00276 · 19.0th percentile
Weaknesses
CWE-215 · Insertion of Sensitive Information Into Debugging Code; CWE-284 · Improper Access Control
Published
2023-12-20T23:27Z
EPSS history
Timeline
  • 20 DEC 23:27Z
    Information Disclosure Vulnerability in Journalpump
    cvelistv5