Read the docs
TI-2022-18726 Aliases CVE-2022-39351

Cleartext storage of sensitive information in DependencyTrack dependency-track

Priority LOW 20CWE-312Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit log in clear text. Actors with access to the audit log can exploit this flaw to gain access to valid API keys. The issue has been fixed in Dependency-Track 4.6.0. Instead of logging the entire API key, only the last 4 characters of the key will be logged. It is strongly recommended to check historic logs for occurrences of this behavior, and re-generating API keys in case of leakage.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00215 11th percentileScored 2026-11-07
Fix Fixed dependency-track (DependencyTrack): 4.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DependencyTrackdependency-trackbefore 4.6.04.6.0Patch availableCNA
  • dependency-track VendorDependencyTrack Affected before 4.6.0 Fixed in 4.6.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:owasp:dependency-track:*:*:*:*:*:*:*:*before 4.6.0Vulnerableowasp-modsecurity
  • cpe:2.3:a:owasp:dependency-track:*:*:*:*:*:*:*:* Versions before 4.6.0 Vulnerable ·owasp-modsecurity

Remediation

  • Fix · CNA dependency-track (DependencyTrack) Fixed in 4.6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-39351

References

Advisory 2

Other 1

  • TI-2025-19994 Dependency-Track vulnerable to local file inclusion via custom notification templates CVSS 3.1MEDIUM 4.4
  • TI-2024-36157 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint CVSS 3.1MEDIUM 5.3
  • TI-2025-40096 @dependencytrack/frontend Vulnerable to Persistent Cross-Site-Scripting via Welcome Message CVSS 3.1MEDIUM 4.8
  • TI-2025-38169 Dependency-Track possibly discloses private NuGet repository credentials to api.nuget.org CVSS 3.1MEDIUM 4.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences