CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1920 vulnerabilities reference this CWE, most recent first.
GHSA-M833-87VF-576C
Vulnerability from github – Published: 2022-05-13 01:37 – Updated: 2023-08-18 21:25ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.ovirt.engine.sdk:ovirt-engine-sdk-java"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.7.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-15113"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-25T22:33:08Z",
"nvd_published_at": "2018-07-27T16:29:00Z",
"severity": "MODERATE"
},
"details": "ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.",
"id": "GHSA-m833-87vf-576c",
"modified": "2023-08-18T21:25:10Z",
"published": "2022-05-13T01:37:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15113"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHEA-2017:3138"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113"
},
{
"type": "WEB",
"url": "https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=commitdiff;h=f4a5d0cc772127dbfe40789e26c4633ceea07d14;hp=e6e8704ac9eb115624ff66e2965877d8e63a45f4"
},
{
"type": "PACKAGE",
"url": "https://github.com/oVirt/ovirt-engine"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20210124121521/https://www.securityfocus.com/bid/101933"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "ovirt-engine Logs Plaintext Passwords To File",
"withdrawn": "2023-08-18T21:25:10Z"
}
GHSA-M87F-39Q9-6F55
Vulnerability from github – Published: 2022-04-05 17:47 – Updated: 2022-04-05 17:47Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.
Upgrade to notebook version 6.4.10
For more information
If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list security@ipython.org.
Credit: @3coins for reporting. Thank you!
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "notebook"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-24758"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2022-04-05T17:47:26Z",
"nvd_published_at": "2022-03-31T23:15:00Z",
"severity": "HIGH"
},
"details": "Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.\n\nUpgrade to notebook version 6.4.10\n\n### For more information\n\nIf you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).\n\nCredit: @3coins for reporting. Thank you!\n\n",
"id": "GHSA-m87f-39q9-6f55",
"modified": "2022-04-05T17:47:26Z",
"published": "2022-04-05T17:47:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24758"
},
{
"type": "PACKAGE",
"url": "https://github.com/jupyter/notebook"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/notebook/PYSEC-2022-180.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Sensitive Auth \u0026 Cookie data stored in Jupyter server logs"
}
GHSA-M88W-QCR5-CQ82
Vulnerability from github – Published: 2024-07-22 15:32 – Updated: 2024-07-22 15:32In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases
{
"affected": [],
"aliases": [
"CVE-2024-41824"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-22T15:15:04Z",
"severity": "MODERATE"
},
"details": "In JetBrains TeamCity before 2024.07 parameters of the \"password\" type could leak into the build log in some specific cases",
"id": "GHSA-m88w-qcr5-cq82",
"modified": "2024-07-22T15:32:42Z",
"published": "2024-07-22T15:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-41824"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M8CW-854G-5GVM
Vulnerability from github – Published: 2024-08-26 09:30 – Updated: 2024-08-26 09:30Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled.
This issue affects:
- OTRS from 7.0.X through 7.0.50
- OTRS 8.0.X
- OTRS 2023.X
- OTRS from 2024.X through 2024.5.X
- ((OTRS)) Community Edition: 6.0.x
Products based on the ((OTRS)) Community Edition also very likely to be affected
{
"affected": [],
"aliases": [
"CVE-2024-43444"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-26T09:15:04Z",
"severity": "HIGH"
},
"details": "Passwords of agents and customers are displayed in plain text in the OTRS admin log module if certain configurations regarding the authentication sources match and debugging for the authentication backend has been enabled.\n\nThis issue affects: \n\n * OTRS from 7.0.X through 7.0.50\n * OTRS 8.0.X\n * OTRS 2023.X\n * OTRS from 2024.X through 2024.5.X\n * ((OTRS)) Community Edition: 6.0.x\n\nProducts based on the ((OTRS)) Community Edition also very likely to be affected",
"id": "GHSA-m8cw-854g-5gvm",
"modified": "2024-08-26T09:30:44Z",
"published": "2024-08-26T09:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43444"
},
{
"type": "WEB",
"url": "https://otrs.com/release-notes/otrs-security-advisory-2024-12"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M8P9-V77C-RQ98
Vulnerability from github – Published: 2022-01-27 00:01 – Updated: 2022-02-01 00:00Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.
{
"affected": [],
"aliases": [
"CVE-2021-36289"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-25T23:15:00Z",
"severity": "HIGH"
},
"details": "Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A local malicious user may exploit this vulnerability to read sensitive information and use it.",
"id": "GHSA-m8p9-v77c-rq98",
"modified": "2022-02-01T00:00:48Z",
"published": "2022-01-27T00:01:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36289"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000191155/dsa-2021-164-dell-vnx2-control-station-security-update-for-multiple-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M8V3-F26V-MHFJ
Vulnerability from github – Published: 2023-07-26 06:30 – Updated: 2024-04-04 06:21The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.
{
"affected": [],
"aliases": [
"CVE-2023-20891"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-26T06:15:10Z",
"severity": "MODERATE"
},
"details": "The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs.\u00a0A malicious non-admin user who has access to the platform system audit logs can access hex encoded CF API admin credentials and can push new malicious versions of an application. In a default deployment non-admin users do not have access to the platform system audit logs.",
"id": "GHSA-m8v3-f26v-mhfj",
"modified": "2024-04-04T06:21:37Z",
"published": "2023-07-26T06:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20891"
},
{
"type": "WEB",
"url": "https://www.vmware.com/security/advisories/VMSA-2023-0016.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M9CQ-WCFF-6M72
Vulnerability from github – Published: 2022-05-24 17:09 – Updated: 2022-05-24 17:09Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.
{
"affected": [],
"aliases": [
"CVE-2020-5400"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-27T20:15:00Z",
"severity": "MODERATE"
},
"details": "Cloud Foundry Cloud Controller (CAPI), versions prior to 1.91.0, logs properties of background jobs when they are run, which may include sensitive information such as credentials if provided to the job. A malicious user with access to those logs may gain unauthorized access to resources protected by such credentials.",
"id": "GHSA-m9cq-wcff-6m72",
"modified": "2022-05-24T17:09:51Z",
"published": "2022-05-24T17:09:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5400"
},
{
"type": "WEB",
"url": "https://www.cloudfoundry.org/blog/cve-2020-5400"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M9FJ-GPR4-VJQM
Vulnerability from github – Published: 2024-09-26 06:30 – Updated: 2024-09-26 06:30Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allows remote authenticated users to obtain sensitive information via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2022-49037"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-26T04:15:03Z",
"severity": "MODERATE"
},
"details": "Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allows remote authenticated users to obtain sensitive information via unspecified vectors.",
"id": "GHSA-m9fj-gpr4-vjqm",
"modified": "2024-09-26T06:30:47Z",
"published": "2024-09-26T06:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49037"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M9J8-W3JP-P7WQ
Vulnerability from github – Published: 2022-05-24 17:36 – Updated: 2022-05-24 17:36The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.
{
"affected": [],
"aliases": [
"CVE-2020-35234"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-14T03:15:00Z",
"severity": "HIGH"
},
"details": "The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.",
"id": "GHSA-m9j8-w3jp-p7wq",
"modified": "2022-05-24T17:36:20Z",
"published": "2022-05-24T17:36:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35234"
},
{
"type": "WEB",
"url": "https://blog.nintechnet.com/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/easy-wp-smtp/#developers"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M9WR-C24P-64C9
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2022-05-24 16:52Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset.
{
"affected": [],
"aliases": [
"CVE-2018-20956"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-08T21:15:00Z",
"severity": "MODERATE"
},
"details": "Swann SWWHD-INTCAM-HD devices leave the PSK in logs after a factory reset.",
"id": "GHSA-m9wr-c24p-64c9",
"modified": "2022-05-24T16:52:52Z",
"published": "2022-05-24T16:52:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20956"
},
{
"type": "WEB",
"url": "https://www.pentestpartners.com/security-blog/hacking-swann-home-security-camera-video"
},
{
"type": "WEB",
"url": "https://www.swann.com/au/safe-by-swann-upgrade"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.