CVE-2024-23686

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

CVSS v3.0 5.3 MEDIUM

5.3^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/advisories/GHSA-qqhq-8r2c-c3f5	Third Party Advisory
https://github.com/advisories/GHSA-qqhq-8r2c-c3f5	Third Party Advisory
https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5	Vendor Advisory
https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5	Vendor Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5	Third Party Advisory
https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:owasp:dependency-check::::::maven::*
	cpe:2.3:a:owasp:dependency-check::::::ant::*
	cpe:2.3:a:owasp:dependency-check::::::cli::*

History

26 Jan 2024, 18:21

Type	Values Removed	Values Added
References	~~() https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5 -~~	() https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5 - Vendor Advisory
References	~~() https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5 -~~	() https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5 - Third Party Advisory
References	~~() https://github.com/advisories/GHSA-qqhq-8r2c-c3f5 -~~	() https://github.com/advisories/GHSA-qqhq-8r2c-c3f5 - Third Party Advisory
CWE		CWE-532
First Time		Owasp dependency-check Owasp
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.3
CPE		cpe:2.3:a:owasp:dependency-check::::::maven::* cpe:2.3:a:owasp:dependency-check::::::cli::* cpe:2.3:a:owasp:dependency-check::::::ant::*

19 Jan 2024, 22:52

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-19 22:15

Updated : 2025-06-17 15:15

NVD link : CVE-2024-23686

Mitre link : CVE-2024-23686

JSON object : View

Products Affected

owasp

dependency-check

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/advisories/GHSA-qqhq-8r2c-c3f5", "name": "https://github.com/advisories/GHSA-qqhq-8r2c-c3f5", "tags": ["Third Party Advisory"], "refsource": ""}, {"url": "https://github.com/advisories/GHSA-qqhq-8r2c-c3f5", "name": "https://github.com/advisories/GHSA-qqhq-8r2c-c3f5", "tags": ["Third Party Advisory"], "refsource": ""}, {"url": "https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5", "name": "https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5", "name": "https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5", "tags": ["Vendor Advisory"], "refsource": ""}, {"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5", "name": "https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5", "tags": ["Third Party Advisory"], "refsource": ""}, {"url": "https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5", "name": "https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5", "tags": ["Third Party Advisory"], "refsource": ""}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.\n\n"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-532"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2024-23686", "ASSIGNER": "disclosure@vulncheck.com"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}}, "publishedDate": "2024-01-19T22:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:owasp:dependency-check:*:*:*:*:*:maven:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.0.6", "versionStartIncluding": "9.0.0"}, {"cpe23Uri": "cpe:2.3:a:owasp:dependency-check:*:*:*:*:*:ant:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "9.0.5", "versionStartIncluding": "9.0.0"}, {"cpe23Uri": "cpe:2.3:a:owasp:dependency-check:*:*:*:*:*:cli:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "9.0.5", "versionStartIncluding": "9.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2025-06-17T15:15Z"}