CVE-2024-23686 DependencyCheck Debug Mode Logging of NVD API Key
Attackers can recover NVD API keys from log files when DependencyCheck is run in debug mode, exposing sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23686?
CVE-2024-23686 is a medium-severity vulnerability in owasp:dependency-check, published on 19 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
Weakness: CWE-532
Which versions are affected by CVE-2024-23686?
12 open source packages ship an affected version, including org.owasp:dependency-check-ant, org.owasp:dependency-check-cli and org.owasp:dependency-check-maven. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.owasp:dependency-check-ant Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-ant Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-ant Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-ant Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-cli Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-cli Maven | From 9.0.0 | 9.0.6 |
6 more packages
org.owasp:dependency-check-cli Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-cli Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-maven Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-maven Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-maven Maven | From 9.0.0 | 9.0.6 |
org.owasp:dependency-check-maven Maven | From 9.0.0 | 9.0.6 |
Products include Owasp Dependency-Check.
How do I fix CVE-2024-23686?
Upgrade org.owasp:dependency-check-ant to 9.0.6 or later.
Is CVE-2024-23686 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-23686 exists.
Other vulnerabilities in owasp:dependency-check
Sources
Also known as GHSA-frxm-v7q3-v2wv, GHSA-qqhq-8r2c-c3f5.