CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1747 vulnerabilities reference this CWE, most recent first.
GHSA-3H2W-68PX-R4V5
Vulnerability from github – Published: 2025-10-31 09:30 – Updated: 2025-10-31 15:30Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access. It has been fixed in the following commit: https://github.com/apache/apisix/pull/12629 Users are recommended to upgrade to version 3.14, which fixes this issue.
{
"affected": [],
"aliases": [
"CVE-2025-62232"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-31T09:15:48Z",
"severity": "HIGH"
},
"details": "Sensitive data exposure via logging in basic-auth leads to plaintext usernames and passwords written to error logs and forwarded to log sinks when log level is INFO/DEBUG. This creates a high risk of credential compromise through log access.\nIt has been fixed in the following commit:\u00a0 https://github.com/apache/apisix/pull/12629 \nUsers are recommended to upgrade to version 3.14, which fixes this issue.",
"id": "GHSA-3h2w-68px-r4v5",
"modified": "2025-10-31T15:30:31Z",
"published": "2025-10-31T09:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62232"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/32hdgh570btfhg02hfc7p7ckf9v83259"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/10/30/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3H9G-5X56-226C
Vulnerability from github – Published: 2022-05-06 00:00 – Updated: 2022-05-14 00:03On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and nethsm-thales-install.sh) expose the Net HSM partition password. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
{
"affected": [],
"aliases": [
"CVE-2022-28859"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-05T17:15:00Z",
"severity": "MODERATE"
},
"details": "On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts (nethsm-safenet-install.sh and nethsm-thales-install.sh) expose the Net HSM partition password. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated",
"id": "GHSA-3h9g-5x56-226c",
"modified": "2022-05-14T00:03:30Z",
"published": "2022-05-06T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28859"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K47662005"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HMQ-7955-4976
Vulnerability from github – Published: 2022-05-13 01:36 – Updated: 2022-05-13 01:36IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed File Transfer. IBM X-Force ID: 137042.
{
"affected": [],
"aliases": [
"CVE-2017-1795"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-06T14:29:00Z",
"severity": "MODERATE"
},
"details": "IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSphere MQ Managed File Transfer. IBM X-Force ID: 137042.",
"id": "GHSA-3hmq-7955-4976",
"modified": "2022-05-13T01:36:58Z",
"published": "2022-05-13T01:36:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1795"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/137042"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=swg22012389"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3JH5-RR2Q-XFV7
Vulnerability from github – Published: 2026-05-11 16:11 – Updated: 2026-05-14 20:54Summary
The LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls made via Spring's RestClient and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown HttpClientErrorException message, which is logged at ERROR level by Spring's default exception handling — regardless of the application's DEBUG log level setting.
Impact
The logged data can contain highly sensitive information including:
- Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers
- Personal data (BSN, email addresses, case details) in request/response bodies
- Session tokens in Set-Cookie response headers
This data is exposed to: - Anyone with access to application logs (stdout/log files) - Users with access to logging aggregation tools (e.g. Grafana/Loki) - Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)
Leaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API's security boundary.
Related: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)
Affected Code
com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept in the web module.
Patched Versions
The vulnerability is fixed in: - 12.33.0 (v12 release line) — see PR #600 - 13.26.0 (v13 release line) — see PR #599
The fix removes the request/response report, headers, and response body from the HttpClientErrorException constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).
Mitigation
If you cannot upgrade to a patched version immediately, consider:
- Restricting access to application logs and the Valtimo logging module
- Adjusting the log level for com.ritense.valtimo.web.logging to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:web"
},
"ranges": [
{
"events": [
{
"introduced": "12.4.0"
},
{
"fixed": "12.33.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "com.ritense.valtimo:web"
},
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.26.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44516"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-11T16:11:06Z",
"nvd_published_at": "2026-05-14T17:16:23Z",
"severity": "HIGH"
},
"details": "### Summary\n\nThe `LoggingRestClientCustomizer` in the `web` module automatically intercepts all outgoing HTTP calls made via Spring\u0027s `RestClient` and logs the full request body, response body, and response headers. When an error response is received, this information is included in the thrown `HttpClientErrorException` message, which is logged at ERROR level by Spring\u0027s default exception handling \u2014 regardless of the application\u0027s DEBUG log level setting.\n\n### Impact\n\nThe logged data can contain highly sensitive information including:\n- Authentication credentials (JWT tokens, API keys, OAuth tokens) in request bodies or response headers\n- Personal data (BSN, email addresses, case details) in request/response bodies\n- Session tokens in `Set-Cookie` response headers\n\nThis data is exposed to:\n- Anyone with access to application logs (stdout/log files)\n- Users with access to logging aggregation tools (e.g. Grafana/Loki)\n- Any Valtimo user with the admin role, through the built-in logging module (since Valtimo 12.5.0)\n\nLeaked authentication credentials could be used to impersonate the Valtimo application against the target external API (e.g. ZGW services), compromising that API\u0027s security boundary.\n\nRelated: GHSA-hfrg-mcvw-8mch (similar sensitive data exposure in InboxHandlingService)\n\n### Affected Code\n\n`com.ritense.valtimo.web.logging.LoggingRestClientCustomizer#intercept` in the `web` module.\n\n### Patched Versions\n\nThe vulnerability is fixed in:\n- **12.33.0** (v12 release line) \u2014 see PR #600\n- **13.26.0** (v13 release line) \u2014 see PR #599\n\nThe fix removes the request/response report, headers, and response body from the `HttpClientErrorException` constructor; only the HTTP status code and status text remain. The full request/response report is still emitted at DEBUG level (disabled in production).\n\n### Mitigation\n\nIf you cannot upgrade to a patched version immediately, consider:\n- Restricting access to application logs and the Valtimo logging module\n- Adjusting the log level for `com.ritense.valtimo.web.logging` to WARN or higher (note: this only mitigates the DEBUG logging path; error responses still leak data via the exception message)",
"id": "GHSA-3jh5-rr2q-xfv7",
"modified": "2026-05-14T20:54:40Z",
"published": "2026-05-11T16:11:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo/security/advisories/GHSA-3jh5-rr2q-xfv7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44516"
},
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo/pull/599"
},
{
"type": "WEB",
"url": "https://github.com/valtimo-platform/valtimo/pull/600"
},
{
"type": "PACKAGE",
"url": "https://github.com/valtimo-platform/valtimo"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Valtimo has sensitive data exposure through HTTP request/response logging in LoggingRestClientCustomizer"
}
GHSA-3JHQ-49PH-54F5
Vulnerability from github – Published: 2021-12-16 00:01 – Updated: 2021-12-18 00:01In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-181588752
{
"affected": [],
"aliases": [
"CVE-2021-0991"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-15T19:15:00Z",
"severity": "LOW"
},
"details": "In OnMetadataChangedListener of AdvancedBluetoothDetailsHeaderController.java, there is a possible leak of Bluetooth MAC addresses due to log information disclosure. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-181588752",
"id": "GHSA-3jhq-49ph-54f5",
"modified": "2021-12-18T00:01:22Z",
"published": "2021-12-16T00:01:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0991"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2021-12-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3M4Q-GGCJ-J6M4
Vulnerability from github – Published: 2026-05-28 18:30 – Updated: 2026-07-02 18:07When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster — inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream — CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl — can extract these credentials with zero Kubernetes privilege. calicoctl's default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/projectcalico/calicoctl/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.31.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-6720"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-02T18:07:41Z",
"nvd_published_at": "2026-05-28T17:16:33Z",
"severity": "HIGH"
},
"details": "When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster \u2014 inline kubeconfig (with bearer token), Kubernetes API bearer token, etcd password, and inline PEM-encoded etcd client certificate and key. Any reader of that stderr stream \u2014 CI job logs, session-recording archives, shared support-ticket transcripts, or local filesystem viewers on the host that ran calicoctl \u2014 can extract these credentials with zero Kubernetes privilege. calicoctl\u0027s default log level is panic, so this issue only triggers when verbose logging is explicitly enabled.",
"id": "GHSA-3m4q-ggcj-j6m4",
"modified": "2026-07-02T18:07:41Z",
"published": "2026-05-28T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6720"
},
{
"type": "WEB",
"url": "https://github.com/projectcalico/calico/pull/12535"
},
{
"type": "WEB",
"url": "https://github.com/projectcalico/calico/pull/12536"
},
{
"type": "WEB",
"url": "https://github.com/projectcalico/calico/pull/12537"
},
{
"type": "WEB",
"url": "https://github.com/projectcalico/calico/commit/12908bb48a5bf8cbab5373f4d532509a30cf9b7f"
},
{
"type": "WEB",
"url": "https://github.com/projectcalico/calico/commit/8d87eddcb5eb6efc70c09eb0a33d63137359ea70"
},
{
"type": "WEB",
"url": "https://github.com/projectcalico/calico/commit/ce3ab2b39b5841757cbccf7922c895c47827f562"
},
{
"type": "PACKAGE",
"url": "https://github.com/projectcalico/calico"
},
{
"type": "WEB",
"url": "https://www.tigera.io/security-bulletins/tta-2026-003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Calico Inserts Sensitive Information into Log File"
}
GHSA-3M7Q-MM9C-3R6P
Vulnerability from github – Published: 2024-06-27 21:32 – Updated: 2024-06-27 21:32VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability.
A malicious actor with adjacent access to web/proxy server logging may be able to obtain sensitive information from URLs that are logged.
{
"affected": [],
"aliases": [
"CVE-2024-22276"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-27T21:15:13Z",
"severity": "MODERATE"
},
"details": "VMware Cloud Director Object Storage Extension contains an Insertion of Sensitive Information vulnerability.\n\n\nA malicious actor with adjacent access to \nweb/proxy server logging may be able to obtain sensitive information \nfrom URLs that are logged.",
"id": "GHSA-3m7q-mm9c-3r6p",
"modified": "2024-06-27T21:32:08Z",
"published": "2024-06-27T21:32:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22276"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24372"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3M93-M4Q6-MC6V
Vulnerability from github – Published: 2020-02-26 19:54 – Updated: 2024-09-04 20:27Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.7.0a1"
},
{
"fixed": "2.7.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0a1"
},
{
"fixed": "2.8.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0a1"
},
{
"fixed": "2.9.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-14864"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2020-02-25T02:19:23Z",
"nvd_published_at": "2020-01-02T15:15:00Z",
"severity": "MODERATE"
},
"details": "Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.",
"id": "GHSA-3m93-m4q6-mc6v",
"modified": "2024-09-04T20:27:06Z",
"published": "2020-02-26T19:54:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14864"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/issues/63522"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/63527"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/64273"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/64274"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/64748"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/050f92f96054bf59e283fdec9972323c2ed00348"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/75288a89d0053d6df35c90863fb6c9542d89850e"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/a0ec2976b2716cdecdd7a8f416d96406acd79b7c"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/c76e074e4c71c7621a1ca8159261c1959b5287af"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-3m93-m4q6-mc6v"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-160.yaml"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4950"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible"
}
GHSA-3P4X-R29J-9QQF
Vulnerability from github – Published: 2022-05-14 01:23 – Updated: 2022-05-14 01:23An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka 'Azure IoT Java SDK Information Disclosure Vulnerability'.
{
"affected": [],
"aliases": [
"CVE-2019-0741"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-05T23:29:00Z",
"severity": "HIGH"
},
"details": "An information disclosure vulnerability exists in the way Azure IoT Java SDK logs sensitive information, aka \u0027Azure IoT Java SDK Information Disclosure Vulnerability\u0027.",
"id": "GHSA-3p4x-r29j-9qqf",
"modified": "2022-05-14T01:23:16Z",
"published": "2022-05-14T01:23:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0741"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0741"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106971"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3PHV-44JF-4V33
Vulnerability from github – Published: 2024-03-18 21:31 – Updated: 2025-03-14 03:31Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensitive data stored in the database.
{
"affected": [],
"aliases": [
"CVE-2024-25654"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-18T20:15:08Z",
"severity": "MODERATE"
},
"details": "Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the UMP application server) to access credentials to authenticate to all services, and to decrypt sensitive data stored in the database.",
"id": "GHSA-3phv-44jf-4v33",
"modified": "2025-03-14T03:31:21Z",
"published": "2024-03-18T21:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-25654"
},
{
"type": "WEB",
"url": "https://www.cvcn.gov.it/cvcn/cve/CVE-2024-25654"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.