CVE-2022-24875

Katalog CVE

CVSS 7.5 · High EPSS 0,98%

Kerentanan Insertion of Sensitive Information into Log File pada cve-services. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the `org.conroller.js` code would erroneously log user secrets. This has been resolved in commit `46d98f2b` and should be available in subsequent versions of the software. Users of the software are advised to manually apply the `46d98f2b` commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate.

Rincian

Terbit di NVD

21 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/CVEProject/cve-services/commit/46d98f2b1427fc6ba1c2bc443dc6688fd400f1f4 patch · advisory pihak ketiga
• https://github.com/CVEProject/cve-services/security/advisories/GHSA-rhj9-qx37-7m2m advisory pihak ketiga