Vulnerability · Published Dec 20, 2023 · Assigned by GitHub_M

CVE-2023-51390Information Disclosure Vulnerability in Journalpump

Medium 6.5

In plain English

A medium-severity improper access control in journalpump from Aiven-Open. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 79.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of a service integration in plaintext to the supplied logging pipeline, including credential information contained in the configuration if any. The problem has been patched in journalpump 2.5.0.

Affected products (as reported)

Vendor	Product	Versions
Aiven-Open	journalpump	< 2.5.0

Weakness: CWE-284, CWE-215 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g x_refsource_CONFIRM
https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da x_refsource_MISC