CWE-532

{
  "affected": [],
  "aliases": [
    "CVE-2018-1223"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-09-17T16:29:00Z",
    "severity": "HIGH"
  },
  "details": "Cloud Foundry Container Runtime (kubo-release), versions prior to 0.14.0, may leak UAA and vCenter credentials to application logs. A malicious user with the ability to read the application logs could use these credentials to escalate privileges.",
  "id": "GHSA-gfwv-5245-24h8",
  "modified": "2022-05-13T01:27:58Z",
  "published": "2022-05-13T01:27:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1223"
    },
    {
      "type": "WEB",
      "url": "https://www.cloudfoundry.org/blog/cve-2018-1223"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.jenkins:configuration-as-code"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10345"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-256",
      "CWE-522",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-28T23:07:38Z",
    "nvd_published_at": "2019-07-31T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Configuration as Code Plugin prior to version 1.25 did not treat the proxy password as a secret to be masked when logging or encrypted for export.",
  "id": "GHSA-ggmx-pq89-7mcr",
  "modified": "2022-06-28T23:07:38Z",
  "published": "2022-05-24T16:51:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10345"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/configuration-as-code-plugin/commit/73afe3cb10a723cb06e29c2e5499206aadae3a0d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/configuration-as-code-plugin"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1303"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/07/31/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Plaintext Storage of a Password in Jenkins Configuration as Code Plugin"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/jaegertracing/jaeger"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.18.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-10750"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-12T14:55:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container\u0027s log file to discover the Kafka credentials.",
  "id": "GHSA-gh32-pc56-4c96",
  "modified": "2023-09-15T19:47:45Z",
  "published": "2021-05-18T18:35:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10750"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaegertracing/jaeger/commit/360c38bec3f9718ebba7ddbf0b409b05995f3ace"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1838401"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10750"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaegertracing/jaeger/releases/tag/v1.18.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Information Exposure in jaeger"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-51490"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-01-08T21:15:09Z",
    "severity": "MODERATE"
  },
  "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPMU DEV Defender Security \u2013 Malware Scanner, Login Security \u0026 Firewall.This issue affects Defender Security \u2013 Malware Scanner, Login Security \u0026 Firewall: from n/a through 4.1.0.",
  "id": "GHSA-gh6x-qpj6-x25r",
  "modified": "2026-04-28T21:33:46Z",
  "published": "2024-01-08T21:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51490"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/defender-security/wordpress-defender-security-plugin-4-1-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openbao/openbao"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.0-20241114205727-b1235e585db7"
            },
            {
              "fixed": "0.0.0-20251022165510-cc2c476bac66"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62513"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-22T19:37:53Z",
    "nvd_published_at": "2025-10-22T20:15:38Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nOpenBao\u0027s audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted (HMAC\u0027d).  This impacted the following subsystems:\n\n - When using the ACME functionality of PKI, this would result in short-lived ACME verification challenge codes being leaked in the audit logs.\n - When using the OIDC issuer functionality of the identity subsystem, auth and token response codes along with claims could be leaked in the audit logs.\n\nThird-party plugins may be affected.\n\n### Patches\n\nOpenBao v2.4.2 will patch this issue.\n\n### Workarounds\n\nIf users do not use the above functionality, they are not impacted. ACME verification codes are not usable after verification or challenge expiry so are of limited long-term use.",
  "id": "GHSA-ghfh-fmx4-26h8",
  "modified": "2025-10-23T17:38:22Z",
  "published": "2025-10-22T19:37:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/security/advisories/GHSA-ghfh-fmx4-26h8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62513"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openbao/openbao/commit/cc2c476bac66e1d94776c2629793daec3af625f8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openbao/openbao"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenBao leaks HTTPRawBody in Audit Logs"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.27.2"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filecoin-project/curio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.24.3"
            },
            {
              "fixed": "1.27.3-rc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-209",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-26T22:48:00Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nMultiple HTTP handlers in Curio passed raw database error messages to HTTP clients via `http.Error()`. When the PostgreSQL/YugabyteDB driver (pgx) returned errors, these could contain the database connection string \u2014 including hostname, port, username, and password. Additionally, the internal connection string was constructed with the plaintext password embedded in the URL, which was also included in startup error messages and could surface in logs.\n\n## Details\n\nThree components were affected:\n\n1. **PDP handlers** (`pdp/handlers.go`) \u2014 18+ HTTP error paths passed `err.Error()` directly to HTTP responses. While these endpoints require ECDSA JWT authentication, an authenticated client (e.g., a FilPay service) that triggered a database error would receive the raw pgx error in the HTTP response body. Present since PDP was introduced in v1.25.1.\n\n2. **Market mk12 deal status** (`market/mk12/mk12_utils.go`) \u2014 The `GetDealStatus` handler included `err.Error()` in error responses: `\"failed to query the db for deal status: %s\"`. Present since v1.24.3.\n\n3. **Market mk20 auth middleware** (`market/mk20/http/http.go`) \u2014 Authentication error responses included `err.Error()`, potentially leaking database error details during auth flows. Present since v1.27.2.\n\n### Root Cause\n\nThe database connection string was constructed as:\n```\npostgresql://username:password@host:port/database?...\n```\nThe plaintext password was embedded directly in the URL. When pgx returned connection or query errors, the error text could contain fragments of this connection string. HTTP handlers forwarded these errors verbatim to clients.\n\n## Impact\n\nAn attacker with network access to Curio\u0027s PDP or Market HTTP endpoints and valid authentication credentials could intentionally trigger database errors (e.g., by sending malformed requests that cause SQL failures) and extract the YugabyteDB connection credentials from the error response. With these credentials, the attacker could directly access the database, which serves as Curio\u0027s control plane.\n\nPer Curio\u0027s [security boundary documentation](https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary), these endpoints are expected to be on a trusted network. However, defense-in-depth requires that credentials are never exposed through HTTP responses regardless of network trust assumptions.\n\n## Remediation (PR #919)\n\n1. **Connection string password masking:** The password in the connection string is replaced with `********`. The real password is set separately via `cfg.ConnConfig.Password`, so it never appears in error messages or logs.\n\n2. **HTTP handler sanitization:** All affected handlers now log the detailed error server-side and return a generic error message to the HTTP client.\n\n3. **Error filter (`errFilter`):** A new function in the database layer detects and redacts any error messages containing keywords like \"password\", \"host\", \"port\", or \"://\" before they can propagate.\n\n4. **Prometheus metrics cleanup:** Database connection metrics that could expose connection details were removed from the metrics endpoint.\n\n5. **Security boundary documentation:** A new section documents what Curio expects operators to secure.\n\n## Resources\n\n- Fix: https://github.com/filecoin-project/curio/pull/919\n- Patched release: v1.27.3-rc2",
  "id": "GHSA-gj6x-q8rh-wj6x",
  "modified": "2026-02-26T22:48:00Z",
  "published": "2026-02-26T22:48:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/security/advisories/GHSA-gj6x-q8rh-wj6x"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/pull/919"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/commit/551da78e0123892600d8e6dfe9de7a579055d80b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filecoin-project/curio"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filecoin-project/curio/blob/main/documentation/en/design/README.md#security-boundary"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Curio exposes database credentials to users with network access through verbose HTTP error responses"
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-13881"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-06T19:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In support.c in pam_tacplus 1.3.8 through 1.5.1, the TACACS+ shared secret gets logged via syslog if the DEBUG loglevel and journald are used.",
  "id": "GHSA-gm22-vmf2-hwxg",
  "modified": "2022-05-24T17:19:28Z",
  "published": "2022-05-24T17:19:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13881"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kravietz/pam_tacplus/issues/149"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kravietz/pam_tacplus/commit/4a9852c31c2fd0c0e72fbb689a586aabcfb11cb0"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2020/06/msg00007.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2021/08/msg00006.html"
    },
    {
      "type": "WEB",
      "url": "https://usn.ubuntu.com/4521-1"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisories/11705-security-advisory-50"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2020/06/08/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-3499"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-31T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of agent logs and data is present.",
  "id": "GHSA-gmj6-42q6-cwrf",
  "modified": "2022-11-01T19:00:28Z",
  "published": "2022-11-01T12:00:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3499"
    },
    {
      "type": "WEB",
      "url": "https://www.tenable.com/security/tns-2022-21"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.12.0"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.plugins:mask-passwords"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-10370"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-319",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-28T22:35:52Z",
    "nvd_published_at": "2019-08-07T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure.",
  "id": "GHSA-gp67-c7j2-2qg2",
  "modified": "2022-06-28T22:35:52Z",
  "published": "2022-05-24T16:52:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10370"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/mask-passwords-plugin/pull/20"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/mask-passwords-plugin/commit/aadefdbf319954cf0c5acbe032637e1c0a924f37"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/mask-passwords-plugin"
    },
    {
      "type": "WEB",
      "url": "https://jenkins.io/security/advisory/2019-08-07/#SECURITY-157"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/08/07/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Insertion of Sensitive Information into Log File in Jenkins Mask Passwords Plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-5153"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-02-13T21:59:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in OSIsoft PI Coresight 2016 R2 and earlier versions, and PI Web API 2016 R2 when deployed using the PI AF Services 2016 R2 integrated install kit. An information exposure through server log files vulnerability has been identified, which may allow service account passwords to become exposed for the affected services, potentially leading to unauthorized shutdown of the affected PI services as well as potential reuse of domain credentials.",
  "id": "GHSA-gp6c-fp2m-24q3",
  "modified": "2022-05-17T02:55:19Z",
  "published": "2022-05-17T02:55:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5153"
    },
    {
      "type": "WEB",
      "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-010-01"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/95355"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}