Vulnerability Details CVE-2024-23686
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.007
EPSS Ranking 70.8%
CVSS Severity
CVSS v3 Score 5.3
References
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5
- https://github.com/advisories/GHSA-qqhq-8r2c-c3f5
- https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5
- https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5
Products affected by CVE-2024-23686
-
cpe:2.3:a:owasp:dependency-check:9.0.0
-
cpe:2.3:a:owasp:dependency-check:9.0.1
-
cpe:2.3:a:owasp:dependency-check:9.0.2
-
cpe:2.3:a:owasp:dependency-check:9.0.3
-
cpe:2.3:a:owasp:dependency-check:9.0.4
-
cpe:2.3:a:owasp:dependency-check:9.0.5