Weakness (CWE)
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it (4 mitigations)
-
Architecture and Design, Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
-
Distribution
Remove debug log files before deploying the application into production.
-
Operation
Protect log files against unauthorized read/write.
-
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
Source: MITRE CWE-532
1,027 results · Feed
-
Medium 4.9
Insertion of Sensitive Information into Log File in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. Access tokens may have been logged when a query was made to a spec…
-
Medium 6.8
scp, sftp, ftp servers passwords in supportsave
The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp servers passwords in supportsave. This could allow a remote authenticated attacker to access sensitive information.
-
Medium 5.8
Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability.…
-
Medium 6.5
VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability
The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform syste…
-
Critical 9.0
Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. A …
-
Medium 6.5
IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896.
-
High 8.5
Information Disclosure Vulnerability in Weave GitOps Terraform Controller
Weave GitOps Terraform Controller (aka Weave TF-controller) is a controller for Flux to reconcile Terraform resources in a GitOps way. A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker …
-
Low 3.9
Insertion of Sensitive Information into Log File in GitLab
An information disclosure issue in Gitlab CE/EE affecting all versions from 13.6 prior to 15.11.10, all versions from 16.0 prior to 16.0.6, all versions from 16.1 prior to 16.1.1, resulted in the Sidekiq log including webhook tokens when the log format was se…
-
Medium 4.9
A vulnerability in the logging component of Cisco Duo Authentication Proxy could allow an authenticated, remote attacke…
-
Medium 4.3
In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log
-
Medium 4.3
In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log
-
Medium 6.5
CF workflows leak credentials in system audit logs
Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X vers…
-
Low 3.3
An insertion of sensitive information into log file vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4 and FortiProx…
-
Medium 6.5
Kubernetes secrets-store-csi-driver discloses service account tokens in logs
Kubernetes secrets-store-csi-driver in versions before 1.3.3 discloses service account tokens in logs.
-
High 7.8
Database password exposed in logs in hoppscotch
hoppscotch is an open source API development ecosystem. In versions prior to 2023.4.5 the database password is exposed in the logs when showing the database connection string. Attackers with access to read system logs will be able to elevate privilege with fu…
-
Medium 4.3
In JetBrains TeamCity before 2023.05 parameters of the "password" type from build dependencies could be logged in some …
-
Low 3.3
An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with …
-
High 7.8
QCS 800xA Vulnerability identified in system log files
Insertion of Sensitive Information into Log File vulnerability in ABB QCS 800xA, ABB QCS AC450, ABB Platform Engineering Tools. An attacker, who already has local access to the QCS nodes, could successfully obtain the password for a system user account. Using…
-
High 7.5
Jenkins HashiCorp Vault Plugin has improper masking of credentials
Jenkins HashiCorp Vault Plugin 360.v0a_1c04cf807d and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled.
-
Low 2.0
Insertion of sensitive information into log file in the Open CAS software for Linux maintained by Intel before version …
-
Medium 4.4CVE-2023-21492 Exploited
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypas…
KEV May 19, 2023 -
Medium 4.4
@mittwald/kubernetes's secret contents leaked via debug logging
### Impact When debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources. When running in a Kubernetes cluster, this might expose sens…
-
Medium 4.4
Automation user secret logged to Apache access log
Transmission of credentials within query parameters in Checkmk <= 2.1.0p26, <= 2.0.0p35, and <= 2.2.0b6 (beta) may cause the automation user's secret to be written to the site Apache access log.
-
Medium 5.5
Lightbend Alpakka Kafka logs credentials on debug level
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
-
Medium 5.5
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
-
Critical 9.1
CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single …
-
Low 3.2
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform
Kitchen-Terraform provides a set of Test Kitchen plugins which enable the use of Test Kitchen to converge a Terraform configuration and verify the resulting infrastructure systems with InSpec controls. Kitchen-Terraform v7.0.0 introduced a regression which ca…
-
Medium 5.5
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
-
Medium 5.5
sensitive data exposure in cloud-init logs
When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user.
-
Medium 5.5
AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending
aws-sigv4 is a rust library for low level request signing in the aws cloud platform. The `aws_sigv4::SigningParams` struct had a derived `Debug` implementation. When debug-formatted, it would include a user's AWS access key, AWS secret key, and security token…
-
High 7.2
Debug mode leaks confidential data in Cilium
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. When run in debug mode, Cilium will log the contents of the `cilium-secrets` namespace. This could include data such as TLS private keys for Ingress and GatewayAPI reso…
-
Medium 4.9
The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from app…
-
Low 3.3
In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
-
Medium 5.5
An issue was discovered in Acuant AsureID Sentinel before 5.2.149. It uses the root of the C: drive for the i-Dentify a…
-
Low 3.8
Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File
Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs.
-
Medium 5.5
NGINX Agent vulnerability CVE-2023-1550
Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private …
-
Medium 6.5
Veracode Scan Jenkins Plugin vulnerable to information disclosure
Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and when the Jenkins global system setting debug is enabled and when a scan is configured for remote agent jobs, allows users…
-
Medium 4.2
Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd
GoCD is an open source continuous delivery server. In GoCD versions from 20.5.0 and below 23.1.0, if the server environment is not correctly configured by administrators to provide access to the relevant PostgreSQL or MySQL backup tools, the credentials for d…
-
Medium 5.5
OpenShift Assisted Installer leaks image pull secrets as plaintext in installation logs
A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull contain…
-
Medium 4.2
directus vulnerable to Insertion of Sensitive Information into Log File
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is p…