GHSA-frxm-v7q3-v2wv
Insertion of Sensitive Information into Log File in OWASP DependencyCheck
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.owasp:dependency-check-ant | >= 9.0.0, < 9.0.6 | 9.0.6 |
| Maven | org.owasp:dependency-check-cli | >= 9.0.0, < 9.0.6 | 9.0.6 |
| Maven | org.owasp:dependency-check-maven | >= 9.0.0, < 9.0.6 | 9.0.6 |
Details
As written in the advisory (Markdown source, shown as plain text).
DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.
References
External links from the advisory. They lead to third-party sites.