CVE-2024-23686CWE-532

DependencyCheck Debug Mode Logging of NVD API Key

Medium · published January 19, 2024

CVSS v3.1
5.3
EPSS
1%
Percentile
48.2
In the wild
Unconfirmed
What it is

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00603 · 48.2th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2024-01-19T21:12Z
EPSS history
Timeline
  • 19 JAN 21:12Z
    DependencyCheck Debug Mode Logging of NVD API Key
    cvelistv5