CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
2005 vulnerabilities reference this CWE, most recent first.
GHSA-48JV-63M8-9985
Vulnerability from github – Published: 2023-04-04 15:30 – Updated: 2023-04-11 18:30An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It uses the root of the C: drive for the i-Dentify and Sentinel Installer log files, aka CORE-7362.
{
"affected": [],
"aliases": [
"CVE-2022-48228"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-04T15:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It uses the root of the C: drive for the i-Dentify and Sentinel Installer log files, aka CORE-7362.",
"id": "GHSA-48jv-63m8-9985",
"modified": "2023-04-11T18:30:30Z",
"published": "2023-04-04T15:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48228"
},
{
"type": "WEB",
"url": "https://acuant.com"
},
{
"type": "WEB",
"url": "https://hackandpwn.com/disclosures/CVE-2022-48228.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-48RH-RW8J-QVQV
Vulnerability from github – Published: 2022-05-24 16:54 – Updated: 2022-07-28 00:00In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. The fix was back-ported to LTS 2019.6.7 as well as LTS 2019.3.8.
{
"affected": [],
"aliases": [
"CVE-2019-15507"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-23T06:15:00Z",
"severity": "MODERATE"
},
"details": "In Octopus Deploy versions 2018.8.4 to 2019.7.6, when a web request proxy is configured, an authenticated user (in certain limited special-characters circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.7. The fix was back-ported to LTS 2019.6.7 as well as LTS 2019.3.8.",
"id": "GHSA-48rh-rw8j-qvqv",
"modified": "2022-07-28T00:00:46Z",
"published": "2022-05-24T16:54:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15507"
},
{
"type": "WEB",
"url": "https://github.com/OctopusDeploy/Issues/issues/5761"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-49M7-VP55-6FJX
Vulnerability from github – Published: 2025-02-06 21:32 – Updated: 2025-02-06 21:32Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log.
{
"affected": [],
"aliases": [
"CVE-2024-13416"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-06T19:15:19Z",
"severity": "MODERATE"
},
"details": "Using API in the 2N OS device, authorized user can enable logging, which discloses valid authentication tokens in system log.",
"id": "GHSA-49m7-vp55-6fjx",
"modified": "2025-02-06T21:32:09Z",
"published": "2025-02-06T21:32:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13416"
},
{
"type": "WEB",
"url": "https://www.2n.com/en-GB/download/cve_2024_1341x_2nos_2_46_v1pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4CXW-RRJ3-G8MV
Vulnerability from github – Published: 2022-08-11 00:00 – Updated: 2022-08-13 00:00In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
{
"affected": [],
"aliases": [
"CVE-2022-38133"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-10T16:15:00Z",
"severity": "MODERATE"
},
"details": "In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases",
"id": "GHSA-4cxw-rrj3-g8mv",
"modified": "2022-08-13T00:00:25Z",
"published": "2022-08-11T00:00:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38133"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4FH9-X6RV-736M
Vulnerability from github – Published: 2024-12-06 15:31 – Updated: 2024-12-06 15:31HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.
{
"affected": [],
"aliases": [
"CVE-2024-42196"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-06T15:15:08Z",
"severity": "MODERATE"
},
"details": "HCL Launch stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs.",
"id": "GHSA-4fh9-x6rv-736m",
"modified": "2024-12-06T15:31:21Z",
"published": "2024-12-06T15:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42196"
},
{
"type": "WEB",
"url": "https://support.hcl-software.com/csm?id=kb_article\u0026sysparm_article=KB0117910"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4G6Q-77J7-VVJC
Vulnerability from github – Published: 2023-12-04 15:31 – Updated: 2026-05-08 20:42A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@google-cloud/firestore"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-6460"
],
"database_specific": {
"cwe_ids": [
"CWE-532",
"CWE-922"
],
"github_reviewed": true,
"github_reviewed_at": "2023-12-04T23:13:52Z",
"nvd_published_at": "2023-12-04T13:15:07Z",
"severity": "MODERATE"
},
"details": "A potential logging of the firestore key via logging within nodejs-firestore exists - Developers who were logging objects through this._settings would be logging the firestore key as well potentially exposing it to anyone with logs read access. We recommend upgrading to version 6.1.0 to avoid this issue",
"id": "GHSA-4g6q-77j7-vvjc",
"modified": "2026-05-08T20:42:22Z",
"published": "2023-12-04T15:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6460"
},
{
"type": "WEB",
"url": "https://github.com/googleapis/nodejs-firestore/pull/1742"
},
{
"type": "WEB",
"url": "https://bughunters.google.com/reports/vrp/KNvgo1Wij"
},
{
"type": "PACKAGE",
"url": "https://github.com/googleapis/nodejs-firestore"
},
{
"type": "WEB",
"url": "https://github.com/googleapis/nodejs-firestore/releases/tag/v6.1.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Logging of the firestore key within nodejs-firestore"
}
GHSA-4G7H-2QWJ-W6HW
Vulnerability from github – Published: 2025-12-04 21:31 – Updated: 2025-12-04 21:31Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
{
"affected": [],
"aliases": [
"CVE-2025-12996"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-04T20:16:17Z",
"severity": "MODERATE"
},
"details": "Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances. This issue affects CareLink Network: before December 4, 2025.",
"id": "GHSA-4g7h-2qwj-w6hw",
"modified": "2025-12-04T21:31:05Z",
"published": "2025-12-04T21:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12996"
},
{
"type": "WEB",
"url": "https://www.medtronic.com/en-us/e/product-security/security-bulletins/carelink-network-vulnerabilities.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4GFP-9XP3-F73R
Vulnerability from github – Published: 2026-08-17 18:31 – Updated: 2026-08-17 18:31In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
{
"affected": [],
"aliases": [
"CVE-2026-75057"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T16:17:52Z",
"severity": "MODERATE"
},
"details": "In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log",
"id": "GHSA-4gfp-9xp3-f73r",
"modified": "2026-08-17T18:31:20Z",
"published": "2026-08-17T18:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75057"
},
{
"type": "WEB",
"url": "https://www.jetbrains.com/privacy-security/issues-fixed"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4GXR-H3CG-2J83
Vulnerability from github – Published: 2022-05-13 01:35 – Updated: 2022-05-13 01:35A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensitive data. The vulnerability is due to improper logging of authentication data. An attacker could exploit this vulnerability by monitoring a specific World-Readable file for this authentication data (Cleartext Passwords). An exploit could allow the attacker to gain authentication information for other users. Cisco Bug IDs: CSCvd86602.
{
"affected": [],
"aliases": [
"CVE-2018-0335"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-07T21:29:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in the web portal authentication process of Cisco Prime Collaboration Provisioning could allow an unauthenticated, local attacker to view sensitive data. The vulnerability is due to improper logging of authentication data. An attacker could exploit this vulnerability by monitoring a specific World-Readable file for this authentication data (Cleartext Passwords). An exploit could allow the attacker to gain authentication information for other users. Cisco Bug IDs: CSCvd86602.",
"id": "GHSA-4gxr-h3cg-2j83",
"modified": "2022-05-13T01:35:23Z",
"published": "2022-05-13T01:35:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-0335"
},
{
"type": "WEB",
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-cpcp-id"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104473"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1041069"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4H8H-Q487-WMVF
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable.
{
"affected": [],
"aliases": [
"CVE-2021-3425"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-01T20:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable.",
"id": "GHSA-4h8h-q487-wmvf",
"modified": "2022-05-24T19:03:40Z",
"published": "2022-05-24T19:03:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3425"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1936629"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.