CVE-2024-23686: DependencyCheck Debug Mode Logging of NVD API Key
First published: Fri Jan 19 2024(Updated: )
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
Credit: disclosure@vulncheck.com disclosure@vulncheck.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.owasp:dependency-check-maven | >=9.0.0<9.0.6 | 9.0.6 |
| maven/org.owasp:dependency-check-cli | >=9.0.0<9.0.6 | 9.0.6 |
| maven/org.owasp:dependency-check-ant | >=9.0.0<9.0.6 | 9.0.6 |
| OWASP Dependency-Check | >=9.0.0<=9.0.5 | |
| OWASP Dependency-Check | >=9.0.0<=9.0.5 | |
| OWASP Dependency-Check | >=9.0.0<9.0.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5
- https://nvd.nist.gov/vuln/detail/CVE-2024-23686
- https://github.com/advisories/GHSA-frxm-v7q3-v2wv (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-23686?
CVE-2024-23686 is classified as a medium severity vulnerability due to potential exposure of sensitive information.
How do I fix CVE-2024-23686?
To remediate CVE-2024-23686, upgrade to version 9.0.6 or later of the affected DependencyCheck packages.
Which versions are affected by CVE-2024-23686?
CVE-2024-23686 affects DependencyCheck for Maven versions 9.0.0 to 9.0.6, CLI versions 9.0.0 to 9.0.5, and Ant versions 9.0.0 to 9.0.5.
What does CVE-2024-23686 exploit?
CVE-2024-23686 allows an attacker to recover the NVD API Key from a log file when DependencyCheck is run in debug mode.
What are the implications of CVE-2024-23686?
The implications of CVE-2024-23686 include potential unauthorized access to the NVD API, which can lead to further exploitation.
- agent/weakness
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/references
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/severity
- collector/nvd-cve
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-frxm-v7q3-v2wv
- alias/CVE-2024-23686
- collector/github-advisory
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/tags
- agent/source
- vendor/owasp
- canonical/owasp dependency-check
- version/owasp dependency-check/9.0.0
- version/owasp dependency-check/9.0.5
- package-manager/maven