CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1863 vulnerabilities reference this CWE, most recent first.
GHSA-99GF-FRHC-HG67
Vulnerability from github – Published: 2024-07-10 18:32 – Updated: 2026-04-23 15:32Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.
{
"affected": [],
"aliases": [
"CVE-2024-37270"
],
"database_specific": {
"cwe_ids": [
"CWE-201",
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-10T18:15:04Z",
"severity": "MODERATE"
},
"details": "Insertion of Sensitive Information into Log File vulnerability in TrustedLogin TrustedLogin Vendor.This issue affects TrustedLogin Vendor: from n/a before 1.1.1.",
"id": "GHSA-99gf-frhc-hg67",
"modified": "2026-04-23T15:32:24Z",
"published": "2024-07-10T18:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37270"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/vendor/vulnerability/wordpress-trustedlogin-vendor-plugin-1-1-1-sensitive-data-exposure-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/vendor/wordpress-trustedlogin-vendor-plugin-1-1-1-sensitive-data-exposure-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-99PC-69Q9-JXF2
Vulnerability from github – Published: 2023-10-26 18:30 – Updated: 2025-02-13 19:19Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.
The _xpack/security APIs have been deprecated in Elasticsearch 7.x and were entirely removed in 8.0.0 and later. The only way for a client to use them in Elasticsearch 8.0.0 and later is to provide the Accept: application/json; compatible-with=7 header. Elasticsearch official clients do not use these deprecated APIs.
The list of affected, deprecated APIs, is the following:
POST /_xpack/security/user/{username}
PUT /_xpack/security/user/{username}
PUT /_xpack/security/user/{username}/_password
POST /_xpack/security/user/{username}/_password
PUT /_xpack/security/user/_password
POST /_xpack/security/user/_password
POST /_xpack/security/oauth2/token
DELETE /_xpack/security/oauth2/token
POST /_xpack/security/saml/authenticate
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.elasticsearch:elasticsearch"
},
"ranges": [
{
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.17.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.elasticsearch:elasticsearch"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.9.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-31417"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-30T15:14:03Z",
"nvd_published_at": "2023-10-26T18:15:08Z",
"severity": "MODERATE"
},
"details": "Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when requests to Elasticsearch use certain deprecated URIs for APIs. The impact of this flaw is that sensitive information such as passwords and tokens might be printed in cleartext in Elasticsearch audit logs. Note that audit logging is disabled by default and needs to be explicitly enabled and even when audit logging is enabled, request bodies that could contain sensitive information are not printed to the audit log unless explicitly configured.\n\nThe `_xpack/security` APIs have been deprecated in Elasticsearch 7.x and were entirely removed in 8.0.0 and later. The only way for a client to use them in Elasticsearch 8.0.0 and later is to provide the `Accept: application/json; compatible-with=7` header. Elasticsearch official clients do not use these deprecated APIs.\n\nThe list of affected, deprecated APIs, is the following:\n\n`POST /_xpack/security/user/{username}`\n`PUT /_xpack/security/user/{username}`\n`PUT /_xpack/security/user/{username}/_password`\n`POST /_xpack/security/user/{username}/_password`\n`PUT /_xpack/security/user/_password`\n`POST /_xpack/security/user/_password`\n`POST /_xpack/security/oauth2/token`\n`DELETE /_xpack/security/oauth2/token`\n`POST /_xpack/security/saml/authenticate`",
"id": "GHSA-99pc-69q9-jxf2",
"modified": "2025-02-13T19:19:40Z",
"published": "2023-10-26T18:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31417"
},
{
"type": "WEB",
"url": "https://discuss.elastic.co/t/elasticsearch-8-9-2-and-7-17-13-security-update/342479"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20231130-0006"
},
{
"type": "WEB",
"url": "https://www.elastic.co/community/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Elasticsearch allows insertion of sensitive information into log files when using deprecated URIs"
}
GHSA-99QF-MR8W-29QW
Vulnerability from github – Published: 2022-03-11 00:02 – Updated: 2022-03-19 00:01Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp in the log
{
"affected": [],
"aliases": [
"CVE-2022-25828"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-10T17:47:00Z",
"severity": "LOW"
},
"details": "Information Exposure vulnerability in Watch Active Plugin prior to version 2.2.07.22012751 allows attacker to access password information of connected WiFiAp in the log",
"id": "GHSA-99qf-mr8w-29qw",
"modified": "2022-03-19T00:01:32Z",
"published": "2022-03-11T00:02:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25828"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9C2P-JFMW-FGW7
Vulnerability from github – Published: 2022-08-19 00:00 – Updated: 2022-08-24 00:00** DISPUTED ** An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes "ps auxwwe" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for example, unexpectedly write credentials (from environment variables) to disk in cleartext. NOTE: there are no common circumstances in which qualys-cloud-agent-scan.log can be read by a user other than root; however, the file contents could be exposed through site-specific operational practices. The vendor does NOT characterize this as a vulnerability because the ps data collection is intentional, and would only capture credentials on a machine that was already affected by the CWE-214 weakness.
{
"affected": [],
"aliases": [
"CVE-2022-29550"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-18T13:15:00Z",
"severity": "HIGH"
},
"details": "** DISPUTED ** An issue was discovered in Qualys Cloud Agent 4.8.0-49. It writes \"ps auxwwe\" output to the /var/log/qualys/qualys-cloud-agent-scan.log file. This may, for example, unexpectedly write credentials (from environment variables) to disk in cleartext. NOTE: there are no common circumstances in which qualys-cloud-agent-scan.log can be read by a user other than root; however, the file contents could be exposed through site-specific operational practices. The vendor does NOT characterize this as a vulnerability because the ps data collection is intentional, and would only capture credentials on a machine that was already affected by the CWE-214 weakness.",
"id": "GHSA-9c2p-jfmw-fgw7",
"modified": "2022-08-24T00:00:31Z",
"published": "2022-08-19T00:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29550"
},
{
"type": "WEB",
"url": "https://blog.qualys.com/product-tech/2022/08/15/qualys-security-updates-cloud-agent-for-linux"
},
{
"type": "WEB",
"url": "https://blog.qualys.com/vulnerabilities-threat-research"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/168367/Qualys-Cloud-Agent-Arbitrary-Code-Execution.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Sep/10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9C9H-VR4P-FJQ2
Vulnerability from github – Published: 2022-05-24 16:44 – Updated: 2024-04-04 00:03All versions of unity-scope-gdrive logs search terms to syslog.
{
"affected": [],
"aliases": [
"CVE-2015-1343"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-22T16:29:00Z",
"severity": "MODERATE"
},
"details": "All versions of unity-scope-gdrive logs search terms to syslog.",
"id": "GHSA-9c9h-vr4p-fjq2",
"modified": "2024-04-04T00:03:15Z",
"published": "2022-05-24T16:44:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1343"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/unity-scope-gdrive/+bug/1509076"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9CCM-QCM5-WRX4
Vulnerability from github – Published: 2022-05-17 00:22 – Updated: 2022-05-17 00:22Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.
{
"affected": [],
"aliases": [
"CVE-2017-1000171"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-03T18:29:00Z",
"severity": "CRITICAL"
},
"details": "Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.",
"id": "GHSA-9ccm-qcm5-wrx4",
"modified": "2022-05-17T00:22:01Z",
"published": "2022-05-17T00:22:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000171"
},
{
"type": "WEB",
"url": "https://github.com/MaharaProject/mahara-mobile/issues/33"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9CQM-Q2HJ-45R7
Vulnerability from github – Published: 2026-09-04 18:31 – Updated: 2026-09-04 18:31IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to credentials being written to trace logs in cleartext.
{
"affected": [],
"aliases": [
"CVE-2026-17442"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T17:16:54Z",
"severity": "MODERATE"
},
"details": "IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to credentials being written to trace logs in cleartext.",
"id": "GHSA-9cqm-q2hj-45r7",
"modified": "2026-09-04T18:31:30Z",
"published": "2026-09-04T18:31:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-17442"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7286372"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9CXC-M8XM-7C7X
Vulnerability from github – Published: 2024-09-12 15:33 – Updated: 2024-10-02 15:30Possible Insertion of Sensitive Information into Log File Vulnerability
in Identity Manager has been discovered in OpenText™ Identity Manager REST Driver. This impact version before 1.1.2.0200.
{
"affected": [],
"aliases": [
"CVE-2022-26322"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-12T13:15:10Z",
"severity": "MODERATE"
},
"details": "Possible Insertion of Sensitive Information into Log File Vulnerability\n\nin Identity Manager has been discovered in\nOpenText\u2122 \nIdentity Manager REST Driver. This impact version before 1.1.2.0200.",
"id": "GHSA-9cxc-m8xm-7c7x",
"modified": "2024-10-02T15:30:36Z",
"published": "2024-09-12T15:33:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26322"
},
{
"type": "WEB",
"url": "https://www.netiq.com/documentation/identity-manager-48-drivers/RESTDriver1.1.2.0300_readme/data/RESTDriver1.1.2.0300_readme.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9F54-6R7J-3HPH
Vulnerability from github – Published: 2022-04-30 18:18 – Updated: 2022-04-30 18:18The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.
{
"affected": [],
"aliases": [
"CVE-2001-1556"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2001-12-31T05:00:00Z",
"severity": "MODERATE"
},
"details": "The log files in Apache web server contain information directly supplied by clients and does not filter or quote control characters, which could allow remote attackers to hide HTTP requests and spoof source IP addresses when logs are viewed with UNIX programs such as cat, tail, and grep.",
"id": "GHSA-9f54-6r7j-3hph",
"modified": "2022-04-30T18:18:18Z",
"published": "2022-04-30T18:18:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2001-1556"
},
{
"type": "WEB",
"url": "http://archives.neohapsis.com/archives/bugtraq/2001-10/0231.html"
},
{
"type": "WEB",
"url": "http://httpd.apache.org/docs/logs.html"
},
{
"type": "WEB",
"url": "http://www.iss.net/security_center/static/7363.php"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-9F7J-84Q4-6VJ2
Vulnerability from github – Published: 2023-07-06 19:24 – Updated: 2025-03-11 18:31A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3, iOS 15.7.3 and iPadOS 15.7.3, watchOS 9.3, iOS 16.3 and iPadOS 16.3, macOS Big Sur 11.7.3. An app may be able to access information about a user’s contacts.
{
"affected": [],
"aliases": [
"CVE-2023-23505"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-27T20:15:00Z",
"severity": "LOW"
},
"details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.2, macOS Monterey 12.6.3, iOS 15.7.3 and iPadOS 15.7.3, watchOS 9.3, iOS 16.3 and iPadOS 16.3, macOS Big Sur 11.7.3. An app may be able to access information about a user\u2019s contacts.",
"id": "GHSA-9f7j-84q4-6vj2",
"modified": "2025-03-11T18:31:57Z",
"published": "2023-07-06T19:24:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-23505"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213598"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213599"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213603"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213604"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213605"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213606"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.