Common Weakness Enumeration

CWE-532

Allowed

Insertion of Sensitive Information into Log File

Abstraction: Base · Status: Incomplete

API response cwe.mitre.org

The product writes sensitive information to a log file.

2005 vulnerabilities reference this CWE, most recent first.

GHSA-2MC4-J865-9Q4R

Vulnerability from github – Published: 2026-08-20 18:43 – Updated: 2026-08-20 18:43
VLAI
Summary
netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages
Details

Summary

io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl exposes raw HPKE private key bytes in string representations and error messages. BoringSSLAsymmetricCipherKeyPair.toString() includes the private-key parameter object, and BoringSSLAsymmetricKeyParameter.toString() renders the full byte array with Arrays.toString(bytes). Separately, failed native key initialization includes Arrays.toString(privateKeyBytes) in the thrown IllegalArgumentException message. Applications that log key-pair objects or exceptions can persist private key material in logs.

Details

codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java renders private key material through toString():

  • BoringSSLAsymmetricCipherKeyPair.toString() at lines 72-78 concatenates "privateKey=" + privateKey.
  • privateKey is a BoringSSLAsymmetricKeyParameter created with isPrivate=true at lines 26-36.

codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java then renders all bytes:

  • BoringSSLAsymmetricKeyParameter.toString() at lines 70-76 returns "bytes=" + Arrays.toString(bytes) regardless of whether isPrivate is true.

A separate error path in codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java also exposes caller-provided private key bytes:

  • EVP_HPKE_KEY_init_or_throw(...) at lines 228-232 throws IllegalArgumentException("privateKeyBytes does not contain a valid private key: " + Arrays.toString(privateKeyBytes)) when BoringSSL rejects the key.

Because Java logging frameworks commonly call toString() for structured objects and commonly persist exception messages, these paths can place complete HPKE private key material in logs or telemetry.

Proof of concept

Safe local verification was performed without native BoringSSL by compiling the relevant Java classes and a no-op native stub for the unused finalizer reference. The observed output includes the full private key byte array:

BoringSSLAsymmetricCipherKeyPair{privateKey=BoringSSLAsymmetricKeyParameter{bytes=[1, 2, 3, 4], isPrivate=true}, publicKey=BoringSSLAsymmetricKeyParameter{bytes=[5, 6, 7, 8], isPrivate=false}}

Minimal reproducer concept in the same package:

package io.netty.incubator.codec.hpke.boringssl;

public final class VerifyPrivateKeyToString {
  public static void main(String[] args) {
    byte[] privateKey = new byte[] {1, 2, 3, 4};
    byte[] publicKey = new byte[] {5, 6, 7, 8};
    BoringSSLAsymmetricCipherKeyPair pair = new BoringSSLAsymmetricCipherKeyPair(privateKey, publicKey);
    System.out.println(pair.toString());
  }
}

The code path is deterministic: the production toString() methods concatenate the raw private-key byte array.

Impact

If an affected key pair or initialization exception is logged, application logs contain complete HPKE private key material. Anyone with access to those logs can recover the key. Depending on key reuse and log retention, this can compromise:

  • confidentiality of OHTTP messages encrypted to the exposed key;
  • integrity/authenticity expectations for future messages if the key remains active;
  • incident response and key rotation assumptions, because logs may retain key material long after the in-memory key is rotated.

Suggested remediation

  • Redact private key material in BoringSSLAsymmetricKeyParameter.toString() when isPrivate is true, for example bytes=<redacted> or only key type/length.
  • Redact privateKey in BoringSSLAsymmetricCipherKeyPair.toString().
  • Remove Arrays.toString(privateKeyBytes) from BoringSSL.EVP_HPKE_KEY_init_or_throw(...); report only length and KEM metadata.
  • Add regression tests asserting that toString() and exception messages do not contain private key byte values.
  • Consider making key pair classes avoid implementing detailed toString() for sensitive material entirely.

References

  • codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java:72-78
  • codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java:70-76
  • codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java:228-232
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.0.22.Final"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.23.Final"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-61798"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-312",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-20T18:43:17Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\n`io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` exposes raw HPKE private key bytes in string representations and error messages. `BoringSSLAsymmetricCipherKeyPair.toString()` includes the private-key parameter object, and `BoringSSLAsymmetricKeyParameter.toString()` renders the full byte array with `Arrays.toString(bytes)`. Separately, failed native key initialization includes `Arrays.toString(privateKeyBytes)` in the thrown `IllegalArgumentException` message. Applications that log key-pair objects or exceptions can persist private key material in logs.\n\n## Details\n\n`codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java` renders private key material through `toString()`:\n\n- `BoringSSLAsymmetricCipherKeyPair.toString()` at lines 72-78 concatenates `\"privateKey=\" + privateKey`.\n- `privateKey` is a `BoringSSLAsymmetricKeyParameter` created with `isPrivate=true` at lines 26-36.\n\n`codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java` then renders all bytes:\n\n- `BoringSSLAsymmetricKeyParameter.toString()` at lines 70-76 returns `\"bytes=\" + Arrays.toString(bytes)` regardless of whether `isPrivate` is true.\n\nA separate error path in `codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java` also exposes caller-provided private key bytes:\n\n- `EVP_HPKE_KEY_init_or_throw(...)` at lines 228-232 throws `IllegalArgumentException(\"privateKeyBytes does not contain a valid private key: \" + Arrays.toString(privateKeyBytes))` when BoringSSL rejects the key.\n\nBecause Java logging frameworks commonly call `toString()` for structured objects and commonly persist exception messages, these paths can place complete HPKE private key material in logs or telemetry.\n\n## Proof of concept\n\nSafe local verification was performed without native BoringSSL by compiling the relevant Java classes and a no-op native stub for the unused finalizer reference. The observed output includes the full private key byte array:\n\n```text\nBoringSSLAsymmetricCipherKeyPair{privateKey=BoringSSLAsymmetricKeyParameter{bytes=[1, 2, 3, 4], isPrivate=true}, publicKey=BoringSSLAsymmetricKeyParameter{bytes=[5, 6, 7, 8], isPrivate=false}}\n```\n\nMinimal reproducer concept in the same package:\n\n```java\npackage io.netty.incubator.codec.hpke.boringssl;\n\npublic final class VerifyPrivateKeyToString {\n  public static void main(String[] args) {\n    byte[] privateKey = new byte[] {1, 2, 3, 4};\n    byte[] publicKey = new byte[] {5, 6, 7, 8};\n    BoringSSLAsymmetricCipherKeyPair pair = new BoringSSLAsymmetricCipherKeyPair(privateKey, publicKey);\n    System.out.println(pair.toString());\n  }\n}\n```\n\nThe code path is deterministic: the production `toString()` methods concatenate the raw private-key byte array.\n\n## Impact\n\nIf an affected key pair or initialization exception is logged, application logs contain complete HPKE private key material. Anyone with access to those logs can recover the key. Depending on key reuse and log retention, this can compromise:\n\n- confidentiality of OHTTP messages encrypted to the exposed key;\n- integrity/authenticity expectations for future messages if the key remains active;\n- incident response and key rotation assumptions, because logs may retain key material long after the in-memory key is rotated.\n\n## Suggested remediation\n\n- Redact private key material in `BoringSSLAsymmetricKeyParameter.toString()` when `isPrivate` is true, for example `bytes=\u003credacted\u003e` or only key type/length.\n- Redact `privateKey` in `BoringSSLAsymmetricCipherKeyPair.toString()`.\n- Remove `Arrays.toString(privateKeyBytes)` from `BoringSSL.EVP_HPKE_KEY_init_or_throw(...)`; report only length and KEM metadata.\n- Add regression tests asserting that `toString()` and exception messages do not contain private key byte values.\n- Consider making key pair classes avoid implementing detailed `toString()` for sensitive material entirely.\n\n## References\n\n- `codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricCipherKeyPair.java:72-78`\n- `codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSLAsymmetricKeyParameter.java:70-76`\n- `codec-ohttp-hpke-classes-boringssl/src/main/java/io/netty/incubator/codec/hpke/boringssl/BoringSSL.java:228-232`",
  "id": "GHSA-2mc4-j865-9q4r",
  "modified": "2026-08-20T18:43:18Z",
  "published": "2026-08-20T18:43:17Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-2mc4-j865-9q4r"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/netty/netty-incubator-codec-ohttp"
    },
    {
      "type": "WEB",
      "url": "https://github.com/netty/netty-incubator-codec-ohttp/releases/tag/netty-incubator-codec-parent-ohttp-0.0.23.Final"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "netty-incubator-codec-ohttp: BoringSSL HPKE private key bytes exposed through toString() and exception messages"
}

GHSA-2MF5-R62X-GR5C

Vulnerability from github – Published: 2025-04-22 12:31 – Updated: 2025-08-25 03:33
VLAI
Details

Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p29, <2.2.0p41 and <=2.1.0p49 (EOL) causes remote site authentication secrets to be written to log files accessible to administrators.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.1 (High)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-2092"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-22T12:15:15Z",
    "severity": "HIGH"
  },
  "details": "Insertion of Sensitive Information into Log File in Checkmk GmbH\u0027s Checkmk versions \u003c2.3.0p29, \u003c2.2.0p41 and \u003c=2.1.0p49 (EOL) causes remote site authentication secrets to be written to log files accessible to administrators.",
  "id": "GHSA-2mf5-r62x-gr5c",
  "modified": "2025-08-25T03:33:06Z",
  "published": "2025-04-22T12:31:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2092"
    },
    {
      "type": "WEB",
      "url": "https://checkmk.com/werk/17780"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-2MHX-FMHX-VPCC

Vulnerability from github – Published: 2024-02-09 00:31 – Updated: 2024-02-15 18:30
VLAI
Details

The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-47131"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-08T23:15:09Z",
    "severity": "HIGH"
  },
  "details": "The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.",
  "id": "GHSA-2mhx-fmhx-vpcc",
  "modified": "2024-02-15T18:30:40Z",
  "published": "2024-02-09T00:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47131"
    },
    {
      "type": "WEB",
      "url": "https://me.n-able.com/s/security-advisory/aArHs000000M8CCKA0/cve202347131-passportal-browser-extension-logs-sensitive-data"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2P66-P32J-X932

Vulnerability from github – Published: 2026-09-16 21:32 – Updated: 2026-09-16 21:32
VLAI
Details

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.

Severity
3.0 (Low)
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
2.1 (Low)
CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-73442"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T19:17:31Z",
    "severity": "LOW"
  },
  "details": "On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.",
  "id": "GHSA-2p66-p32j-x932",
  "modified": "2026-09-16T21:32:43Z",
  "published": "2026-09-16T21:32:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73442"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-2PFV-Q6J2-PCRF

Vulnerability from github – Published: 2023-10-04 15:30 – Updated: 2024-01-02 00:30
VLAI
Details

A logic flaw exists in Ansible. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.

Severity
6.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-4380"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-10-04T15:15:12Z",
    "severity": "MODERATE"
  },
  "details": "A logic flaw exists in Ansible. Whenever a private project is created with incorrect credentials, they are logged in plaintext. This flaw allows an attacker to retrieve the credentials from the log, resulting in the loss of confidentiality, integrity, and availability.",
  "id": "GHSA-2pfv-q6j2-pcrf",
  "modified": "2024-01-02T00:30:21Z",
  "published": "2023-10-04T15:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4380"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2023:4693"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2023-4380"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2232324"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2PVH-XF99-R989

Vulnerability from github – Published: 2022-05-14 01:17 – Updated: 2022-05-14 01:17
VLAI
Details

In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates exploitation of SQL injection errors.

Severity
7.5 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2018-19513"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-21T16:00:00Z",
    "severity": "HIGH"
  },
  "details": "In Webgalamb through 7.0, log files are exposed to the internet with predictable files/logs/sql_error_log/YYYY-MM-DD-sql_error_log.log filenames. The log file could contain sensitive client data (email addresses) and also facilitates exploitation of SQL injection errors.",
  "id": "GHSA-2pvh-xf99-r989",
  "modified": "2022-05-14T01:17:43Z",
  "published": "2022-05-14T01:17:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19513"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/151017/Webgalamb-Information-Disclosure-XSS-CSRF-SQL-Injection.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2019/Jan/15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2Q32-MMXP-HXR7

Vulnerability from github – Published: 2026-03-05 09:30 – Updated: 2026-03-05 09:30
VLAI
Details

HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.

Severity
3.3 (Low)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-21786"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-05T08:15:58Z",
    "severity": "LOW"
  },
  "details": "HCL Sametime for iOS is impacted by a sensitive information disclosure.  Hostnames information is written in application logs and certain URLs.",
  "id": "GHSA-2q32-mmxp-hxr7",
  "modified": "2026-03-05T09:30:34Z",
  "published": "2026-03-05T09:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21786"
    },
    {
      "type": "WEB",
      "url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0128949"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2Q4F-GJPQ-VFMH

Vulnerability from github – Published: 2025-03-11 18:32 – Updated: 2025-10-22 00:33
VLAI
Details

Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.

Severity
4.6 (Medium)
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2025-24984"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-11T17:16:34Z",
    "severity": "MODERATE"
  },
  "details": "Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.",
  "id": "GHSA-2q4f-gjpq-vfmh",
  "modified": "2025-10-22T00:33:14Z",
  "published": "2025-03-11T18:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24984"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24984"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24984"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2QPF-6HHX-QXXG

Vulnerability from github – Published: 2022-05-10 00:00 – Updated: 2022-05-18 00:00
VLAI
Details

An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode. To exploit this vulnerability, the attacker would need to have valid user credentials and turn on debug mode.

Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-28161"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-09T17:15:00Z",
    "severity": "MODERATE"
  },
  "details": "An information exposure through log file vulnerability in Brocade SANNav versions before Brocade SANnav 2.2.0 could allow an authenticated, local attacker to view sensitive information such as ssh passwords in filetansfer.log in debug mode. To exploit this vulnerability, the attacker would need to have valid user credentials and turn on debug mode.",
  "id": "GHSA-2qpf-6hhx-qxxg",
  "modified": "2022-05-18T00:00:32Z",
  "published": "2022-05-10T00:00:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28161"
    },
    {
      "type": "WEB",
      "url": "https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2022-1840"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-2R5R-X58V-CX3W

Vulnerability from github – Published: 2021-05-25 20:05 – Updated: 2021-12-20 17:46
VLAI
Summary
Information Disclosure in OpenShift Container Platform
Details

A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity.

Severity
7.0 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-10712"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-04-22T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity.",
  "id": "GHSA-2r5r-x58v-cx3w",
  "modified": "2021-12-20T17:46:48Z",
  "published": "2021-05-25T20:05:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10712"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10712"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Information Disclosure in OpenShift Container Platform"
}
Mitigation
Architecture and Design Implementation

Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.

Mitigation
Distribution

Remove debug log files before deploying the application into production.

Mitigation
Operation

Protect log files against unauthorized read/write.

Mitigation
Implementation

Adjust configurations appropriately when software is transitioned from a debug state to production.

CAPEC-215: Fuzzing for application mapping

An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.

← Back to the CWE list