CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1745 vulnerabilities reference this CWE, most recent first.
GHSA-784X-8M4V-C8CC
Vulnerability from github – Published: 2022-05-13 01:53 – Updated: 2022-05-13 01:53inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites.
{
"affected": [],
"aliases": [
"CVE-2018-7204"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-07T20:29:00Z",
"severity": "HIGH"
},
"details": "inc/logger.php in the Giribaz File Manager plugin before 5.0.2 for WordPress logged activity related to the plugin in /wp-content/uploads/file-manager/log.txt. If a user edits the wp-config.php file using this plugin, the wp-config.php contents get added to log.txt, which is not protected and contains database credentials, salts, etc. These files have been indexed by Google and a simple dork will find affected sites.",
"id": "GHSA-784x-8m4v-c8cc",
"modified": "2022-05-13T01:53:17Z",
"published": "2022-05-13T01:53:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7204"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/1823035/file-manager"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/file-manager/#developers"
},
{
"type": "WEB",
"url": "https://wpvulndb.com/vulnerabilities/9036"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-785X-QW4V-6872
Vulnerability from github – Published: 2022-02-09 22:00 – Updated: 2024-09-05 00:44An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-14330"
],
"database_specific": {
"cwe_ids": [
"CWE-116",
"CWE-117",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-05T16:14:01Z",
"nvd_published_at": "2020-09-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.",
"id": "GHSA-785x-qw4v-6872",
"modified": "2024-09-05T00:44:53Z",
"published": "2022-02-09T22:00:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14330"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/issues/68400"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/69653"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/e0f25a2b1f9e6c21f751ba0ed2dc2eee2152983e"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-785x-qw4v-6872"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-3.yaml"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4950"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible"
}
GHSA-7C2F-R6GC-H92H
Vulnerability from github – Published: 2026-01-16 12:30 – Updated: 2026-06-05 14:25In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.
Users are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0b1"
},
{
"fixed": "3.1.6"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.11.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-68675"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-16T21:00:10Z",
"nvd_published_at": "2026-01-16T11:16:03Z",
"severity": "HIGH"
},
"details": "In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such connections are rendered or printed to logs, proxy credentials embedded in these fields could be exposed.\n\nUsers are recommended to upgrade to 3.1.6 or later for Airflow 3, and 2.11.1 or later for Airflow 2 which fixes this issue.",
"id": "GHSA-7c2f-r6gc-h92h",
"modified": "2026-06-05T14:25:12Z",
"published": "2026-01-16T12:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68675"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/59688"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2026-10.yaml"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/x6kply4nqd4vc4wgxtm6g9r2tt63s8c5"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/01/15/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Airflow proxy credentials for various providers might leak in task logs"
}
GHSA-7C3V-VC3X-X789
Vulnerability from github – Published: 2022-05-24 16:52 – Updated: 2023-10-26 16:24Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked (i.e. replaced with asterisks) in that log to prevent accidental disclosure. Configuration as Code Plugin inspects the type and looks for a field, getter, or constructor argument corresponding to the property, making the secret detection much more robust for the purpose of log message masking. This was implemented in the fix for SECURITY-1279 in the 2019-07-31 security advisory.
That fix was incomplete and did not cover a log message written to the logger io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator.
Configuration as Code Plugin now uses the same secret detection for these log messages.
As a workaround, administrators can configure the logging level of the logger io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator to a level that does not include these messages. Configuration as Code Plugin 1.25 and earlier logs these messages at the INFO level, Configuration as Code Plugin 1.26 logs them at FINE. See the logging documentation for details.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.26"
},
"package": {
"ecosystem": "Maven",
"name": "io.jenkins:configuration-as-code"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10367"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-28T22:36:48Z",
"nvd_published_at": "2019-08-07T15:15:00Z",
"severity": "MODERATE"
},
"details": "Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked (i.e. replaced with asterisks) in that log to prevent accidental disclosure. Configuration as Code Plugin inspects the type and looks for a field, getter, or constructor argument corresponding to the property, making the secret detection much more robust for the purpose of log message masking. This was implemented in the [fix for SECURITY-1279 in the 2019-07-31 security advisory](https://www.jenkins.io/security/advisory/2019-07-31/#SECURITY-1279).\n\nThat fix was incomplete and did not cover a log message written to the logger `io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator`.\n\nConfiguration as Code Plugin now uses the same secret detection for these log messages.\n\nAs a workaround, administrators can configure the logging level of the logger `io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator` to a level that does not include these messages. Configuration as Code Plugin 1.25 and earlier logs these messages at the `INFO` level, Configuration as Code Plugin 1.26 logs them at `FINE`. See the logging documentation for details.",
"id": "GHSA-7c3v-vc3x-x789",
"modified": "2023-10-26T16:24:01Z",
"published": "2022-05-24T16:52:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10367"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/configuration-as-code-plugin/commit/322ef83f3200ce6076129c014209ef938e556774"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-08-07/#SECURITY-1497"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2019-07-31/#SECURITY-1279"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/08/07/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin"
}
GHSA-7CG9-F395-4PCQ
Vulnerability from github – Published: 2022-05-13 01:32 – Updated: 2022-05-13 01:32IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force ID: 148873.
{
"affected": [],
"aliases": [
"CVE-2018-1788"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-11-02T15:29:00Z",
"severity": "MODERATE"
},
"details": "IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force ID: 148873.",
"id": "GHSA-7cg9-f395-4pcq",
"modified": "2022-05-13T01:32:40Z",
"published": "2022-05-13T01:32:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1788"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/148873"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10730357"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/105818"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1042032"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7CH5-P674-P2HP
Vulnerability from github – Published: 2024-11-13 15:31 – Updated: 2024-11-14 18:30An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leakage within the yb_backup log files, exposing the SAS token in plaintext. The leakage occurs during the backup procedure, leading to potential unauthorized access to resources associated with the SAS token. This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.
{
"affected": [],
"aliases": [
"CVE-2024-11165"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-13T15:15:06Z",
"severity": "MODERATE"
},
"details": "An information disclosure vulnerability exists in the backup configuration process where the SAS token is not masked in the configuration response. This oversight results in sensitive information leakage within the yb_backup log files, exposing the SAS token in plaintext. The leakage occurs during the backup procedure, leading to potential unauthorized access to resources associated with the SAS token.\u00a0This issue affects YugabyteDB Anywhere: from 2.20.0.0 before 2.20.7.0, from 2.23.0.0 before 2.23.1.0, from 2024.1.0.0 before 2024.1.3.0.",
"id": "GHSA-7ch5-p674-p2hp",
"modified": "2024-11-14T18:30:34Z",
"published": "2024-11-13T15:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11165"
},
{
"type": "WEB",
"url": "https://github.com/yugabyte/yugabyte-db/commit/920989b6c0db0222bb7a0cce46febc76cf72d438"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-7CJH-XX4R-QH3F
Vulnerability from github – Published: 2025-06-20 13:28 – Updated: 2025-06-20 19:27Impact
Under specific circumstances, text composables may contain unmasked sensitive data in Android session replays. You may be impacted if you meet the following conditions:
- Using any sentry-android with versions < 8.14.0
- Using Jetpack Compose >= 1.8.0-alpha08
- This includes any alpha, beta, release candidate, or general availability after this version
- Have configured Sentry Session Replays for Android
[!IMPORTANT] If you do not use Jetpack Compose or have never used a version >= 1.8.0-alpha08 you are not impacted.
[!IMPORTANT] If you have not configured Session Replays for Mobile you are not impacted.
How do I check if I'm impacted?
If you meet the conditions above, the sentry-android package includes a specific error log that would indicate you may be impacted. Customers may use logcat to search for this event.
I'm impacted and want this data deleted
If you've confirmed that you're affected and unmasked sensitive data in Session Replays have reached Sentry servers, you can please see this documentation on deleting individual replays. If you'd like to request bulk deletion, please reach out to your Account Manager or support@sentry.io to request deletion.
Patches
Upgrade the sentry-android SDK to version 8.14.0
Workarounds
We recommend upgrading to the latest version of the SDK, but if it is not an option, customers may either: - Downgrade their use of Jetpack Compose to <= 1.7.x - Drop session sample rates to 0.0
options.sessionReplay.onErrorSampleRate = 0.0
options.sessionReplay.sessionSampleRate = 0.0
Please see our documentation for more information configuring Session Replays for Android.
References
This issue was identified in Issue https://github.com/getsentry/sentry-java/issues/4467 and fixed in https://github.com/getsentry/sentry-java/pull/4485
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.sentry:sentry-android"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.14.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "io.sentry:sentry-android-replay"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.14.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-20T13:28:26Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Impact\n\nUnder specific circumstances, text composables may contain unmasked sensitive data in Android session replays. You may be impacted if you meet the following conditions:\n- Using any `sentry-android` with versions \u003c 8.14.0 \n- Using Jetpack Compose \u003e= [1.8.0-alpha08](https://developer.android.com/jetpack/androidx/releases/compose-ui#1.8.0-alpha08)\n - This includes any alpha, beta, release candidate, or general availability after this version\n- Have configured Sentry Session Replays for Android\n\n\u003e [!IMPORTANT] \n\u003e If you do not use Jetpack Compose or have never used a version \u003e= 1.8.0-alpha08 you are not impacted. \n\n\u003e [!IMPORTANT] \n\u003e If you have not configured [Session Replays for Mobile](https://docs.sentry.io/product/explore/session-replay/mobile/) you are not impacted.\n\n### How do I check if I\u0027m impacted?\n\nIf you meet the conditions above, the `sentry-android` package includes a [specific error log](https://github.com/getsentry/sentry-java/blob/b2920907e6afb69a8027cedb251dd94a3514f0e6/sentry-android-replay/src/main/java/io/sentry/android/replay/viewhierarchy/ComposeViewHierarchyNode.kt#L252-L261) that would indicate you may be impacted. Customers may use [logcat](https://developer.android.com/tools/logcat) to search for this event.\n\n### I\u0027m impacted and want this data deleted\n\nIf you\u0027ve confirmed that you\u0027re affected and unmasked sensitive data in Session Replays have reached Sentry servers, you can please see this documentation on [deleting individual replays](https://docs.sentry.io/product/explore/session-replay/web/replay-details/#delete-replays). If you\u0027d like to request bulk deletion, please reach out to your Account Manager or support@sentry.io to request deletion. \n\n### Patches\n\nUpgrade the `sentry-android` SDK to version [8.14.0](https://github.com/getsentry/sentry-java/releases/tag/8.14.0)\n\n### Workarounds\n\nWe recommend upgrading to the latest version of the SDK, but if it is not an option, customers may either:\n- Downgrade their use of Jetpack Compose to \u003c= 1.7.x\n- Drop session sample rates to 0.0 \n```\noptions.sessionReplay.onErrorSampleRate = 0.0\noptions.sessionReplay.sessionSampleRate = 0.0\n```\nPlease see our documentation for more information configuring [Session Replays for Android](https://docs.sentry.io/platforms/android/session-replay/#set-up).\n\n### References\n\nThis issue was identified in Issue https://github.com/getsentry/sentry-java/issues/4467 and fixed in https://github.com/getsentry/sentry-java/pull/4485",
"id": "GHSA-7cjh-xx4r-qh3f",
"modified": "2025-06-20T19:27:36Z",
"published": "2025-06-20T13:28:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-java/security/advisories/GHSA-7cjh-xx4r-qh3f"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-java/issues/4467"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-java/pull/4485"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-java/commit/8bfa9cceab402e58f6723a0694158d27e8a41a56"
},
{
"type": "PACKAGE",
"url": "https://github.com/getsentry/sentry-java"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry-java/releases/tag/8.14.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "sentry-android unmasked sensitive data in Android Session Replays for users of Jetpack Compose 1.8+"
}
GHSA-7CP7-JFP6-JH4F
Vulnerability from github – Published: 2023-01-20 17:33 – Updated: 2023-01-25 17:57Impact
The log module contains all kind of sent mails. It is possible to see the password reset email of customers and admin users to gain probably more access.
Patches
Update to the latest 6.4.18.1 version.
Workarounds
- For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
- Remove from all users the log module ACL rights
- Disable logging
References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.4.18.0"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/platform"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.18.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 6.4.18.0"
},
"package": {
"ecosystem": "Packagist",
"name": "shopware/core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.4.18.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-22733"
],
"database_specific": {
"cwe_ids": [
"CWE-117",
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-01-20T17:33:54Z",
"nvd_published_at": "2023-01-17T22:15:00Z",
"severity": "LOW"
},
"details": "### Impact\n\nThe log module contains all kind of sent mails. It is possible to see the password reset email of customers and admin users to gain probably more access.\n\n### Patches\nUpdate to the latest 6.4.18.1 version.\n\n### Workarounds\n- For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. \n- Remove from all users the log module ACL rights\n- [Disable logging](https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging)\n\n### References\nhttps://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates\n\n\n",
"id": "GHSA-7cp7-jfp6-jh4f",
"modified": "2023-01-25T17:57:42Z",
"published": "2023-01-20T17:33:54Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/shopware/platform/security/advisories/GHSA-7cp7-jfp6-jh4f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-22733"
},
{
"type": "WEB",
"url": "https://github.com/shopware/platform/commit/407a83063d7141c1a626441799c3ebef79498c07"
},
{
"type": "WEB",
"url": "https://developer.shopware.com/docs/guides/hosting/performance/performance-tweaks#logging"
},
{
"type": "WEB",
"url": "https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates"
},
{
"type": "PACKAGE",
"url": "https://github.com/shopware/platform"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Shopware\u0027s log module vulnerable to Improper Output Neutralization"
}
GHSA-7FHR-RH46-HQ82
Vulnerability from github – Published: 2022-05-24 16:58 – Updated: 2024-04-04 02:26In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.
{
"affected": [],
"aliases": [
"CVE-2019-17355"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-15T21:15:00Z",
"severity": "CRITICAL"
},
"details": "In the Orbitz application 19.31.1 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.",
"id": "GHSA-7fhr-rh46-hq82",
"modified": "2024-04-04T02:26:29Z",
"published": "2022-05-24T16:58:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17355"
},
{
"type": "WEB",
"url": "https://pastebin.com/GgpFz3ZW"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7GX6-2PR2-4XF4
Vulnerability from github – Published: 2022-05-13 01:21 – Updated: 2022-05-13 01:21Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.
{
"affected": [],
"aliases": [
"CVE-2019-0029"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-15T21:29:00Z",
"severity": "HIGH"
},
"details": "Juniper ATP Series Splunk credentials are logged in a file readable by authenticated local users. Using these credentials an attacker can access the Splunk server. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.",
"id": "GHSA-7gx6-2pr2-4xf4",
"modified": "2022-05-13T01:21:10Z",
"published": "2022-05-13T01:21:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0029"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/JSA10918"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.