Weakness (CWE)
CWE-532: Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.
How to prevent it (4 mitigations)
-
Architecture and Design, Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
-
Distribution
Remove debug log files before deploying the application into production.
-
Operation
Protect log files against unauthorized read/write.
-
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
Source: MITRE CWE-532
1,027 results · Feed
-
High 7.5
Insertion of Sensitive Information into Log File in Apache NiFi
In Apache NiFi 0.0.1 to 1.11.0, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of bot…
-
Medium 5.3
Apache NiFi Insertion of Sensitive Information into Log File
An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.
-
Medium 4.0
yast2-rmt exposes CA private key passhrase in log-file
A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 ya…
-
Medium 4.4
Log injection in SimpleSAMLphp
Log injection in SimpleSAMLphp before version 1.18.4. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an a…
-
Medium 5.4
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system …
-
Unscored —
In OSIsoft PI System multiple products and versions, a local attacker could view sensitive information in log files whe…
-
High 8.8
Pivotal Ops Manager logs query parameters in tomcat access file
Pivotal Ops Manager, versions 2.4.x prior to 2.4.27, 2.5.x prior to 2.5.24, 2.6.x prior to 2.6.16, and 2.7.x prior to 2.7.5, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then t…
-
Medium 5.7
Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would disclos…
-
High 8.8
UAA logs all query parameters with debug logging level
Cloud Foundry UAA Release, versions prior to v74.10.0, when set to logging level DEBUG, logs client_secret credentials when sent as a query parameter. A remote authenticated malicious user could gain access to user credentials via the uaa.log file if authenti…
-
Medium 5.7
FreeIPA logs passwords embedded in commands in calls using batch
A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way that FreeIPA's batch processing API logged operations. This included passing user passwords in clear text on FreeIPA mast…
-
High 8.8
Cloud Foundry UAA logs query parameters in tomcat access file
Cloud Foundry UAA Release, versions prior to v74.8.0, logs all query parameters to tomcat’s access file. If the query parameters are used to provide authentication, ie. credentials, then they will be logged as well.
-
High 7.5
Moodle backs up private files
Moodle before 2.2.2 has users' private files included in course backups
-
High 8.8
Password leak in smbdriver logs
Cloud Foundry SMB Volume, versions prior to v2.0.3, accidentally outputs sensitive information to the logs. A remote user with access to the SMB Volume logs can discover the username and password for volumes that have been recently created, allowing the user …
-
High 7.3
Ansible leaks sensitive information to logs when told not to
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log o…
-
High 7.3
Ansible Uses Plugins That Disclose Credentials
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. …
-
Medium 4.8
Potential to access user credentials from the log files when debug logging enabled
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
-
High 8.8
The RSA Identity Governance and Lifecycle software and RSA Via Lifecycle and Governance products prior to 7.1.0 P08 con…
-
Medium 4.7
Kubernetes client-go logs authorization headers at debug verbosity levels
The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic …
-
Medium 6.5
Hickory Smart Lock Insecure Logging on Android
An inclusion of sensitive information in log files vulnerability is present in Hickory Smart for Android mobile devices from Belwith Products, LLC. Communications to the internet API services and direct connections to the lock via Bluetooth Low Energy (BLE) f…
-
Unscored —
OSIsoft PI Web API 2018 and prior may allow disclosure of sensitive information.
-
Medium 4.9
Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability
A vulnerability in Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to read arbitrary files on the underlying operating system (OS) of an affected device. The vulnerability is due to the improper input validat…
-
Medium 6.5
Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability
A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticated, remote attacker to view a password in clear text. The vulnerability is due to incorrectly logging the admin password when a user is forced …
-
Medium 5.5
Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some values expected to be hidden when logging the configuration being applied.
-
Medium 6.5
Insertion of Sensitive Information into Log File in Jenkins Mask Passwords Plugin
Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure.
-
Medium 6.5
Maven Integration Plugin did not mask sensitive values in module build logs
Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build variables in the build log.
-
Medium 5.5
Jenkins Amazon EC2 Plugin leaked beginning of private key in system log
Jenkins Amazon EC2 Plugin 1.43 and earlier wrote the beginning of private keys to the Jenkins system log.
-
Medium 5.5
Plaintext Storage of a Password in Jenkins Configuration as Code Plugin
Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.
-
Medium 5.5
Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Jenkins Configuration as Code Plugin 1.24 and earlier did not properly apply masking to values expected to be hidden when logging the configuration being applied.
-
Low 2.3
OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes…
-
Low 2.2
PKS Telemetry logs credentials
Pivotal Container Services (PKS) versions 1.3.x prior to 1.3.7, and versions 1.4.x prior to 1.4.1, contains a vulnerable component which logs the username and password to the billing database. A remote authenticated user with access to those logs may be able …
-
High 7.5
Secret insertion into debug log in Docker
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a sta…
-
Medium 5.9
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficientl…
-
Medium 6.0
Bosh Deployment logs leak sensitive information
Cloud Foundry BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.
-
Medium 5.3
Credential exposure through log files in Undertow
A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER…
-
Low 3.5
Sensitive Data Exposure in sequelize-cli
Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text. ## Recommen…
-
Medium 5.5
It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the c…
-
Medium 4.0
Ceilometer Prints Sensitive Configuration Data to Log
A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.
-
Medium 5.5
Openstack Octavia allows Insertion of Sensitive Information into Log File
In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private key…
-
Unscored —
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer …
-
Medium 5.5
Ceph does not properly sanitize encryption keys in debug logging for v4 auth. This results in the leaking of encryption…