Vulnerability · Published Apr 21, 2022 · Assigned by GitHub_M
CVE-2022-24875Potential Secrets being logged to disk in CVEProject/cve-services
Medium 5.3
In plain English
A medium-severity sensitive data in logs in cve-services from CVEProject. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Official description
The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| CVEProject | cve-services | <= 1.1.1 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N