CVE-2022-24875 Potential Secrets being logged to disk in CVEProject/cve-services
Attackers with log access can read user secrets due to improper logging in the CVE Services API, requiring a code patch or manual log cleanup.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24875?
CVE-2022-24875 is a medium-severity vulnerability in CVEProject cve-services, published on 21 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate.
Weakness: CWE-532
Which versions are affected by CVE-2022-24875?
It affects 1 product.
Products include Cve Cve-Services.
How do I fix CVE-2022-24875?
No fix has been published for CVE-2022-24875 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-24875 being exploited?
There is no known exploitation of CVE-2022-24875 in the wild and no public exploit code.