Read the docs
TI-2023-30871 Aliases GHSA-qqhq-8r2c-c3f5

nvdApiKey is logged in debug mode

Priority LOW 38CWE-532Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-532.

Summary

### Summary The value of `nvdApiKey` configuration parameter is logged in clear text in debug mode. ### Details The NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode. Expecting the same behavior as for several password configurations: just print `******` Note that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not. ### PoC The nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice. ### Impact The NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.

Why it matters now

Fix Fixed org.owasp:dependency-check-ant (Maven): 9.0.6org.owasp:dependency-check-cli (Maven): 9.0.6+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—org.owasp:dependency-check-ant (Maven)9.0.0 to before 9.0.69.0.6Patch availableGHSA-qqhq-8r2c-c3f5
—org.owasp:dependency-check-cli (Maven)9.0.0 to before 9.0.69.0.6Patch availableGHSA-qqhq-8r2c-c3f5
—org.owasp:dependency-check-maven (Maven)9.0.0 to before 9.0.69.0.6Patch availableGHSA-qqhq-8r2c-c3f5
  • org.owasp:dependency-check-ant (Maven) Vendor— Affected 9.0.0 to before 9.0.6 Fixed in 9.0.6 Patch available GHSA-qqhq-8r2c-c3f5
  • org.owasp:dependency-check-cli (Maven) Vendor— Affected 9.0.0 to before 9.0.6 Fixed in 9.0.6 Patch available GHSA-qqhq-8r2c-c3f5
  • org.owasp:dependency-check-maven (Maven) Vendor— Affected 9.0.0 to before 9.0.6 Fixed in 9.0.6 Patch available GHSA-qqhq-8r2c-c3f5

Remediation

  • Fix · GHSA-qqhq-8r2c-c3f5 org.owasp:dependency-check-ant (Maven) Fixed in 9.0.6 Advisory →
  • Fix · GHSA-qqhq-8r2c-c3f5 org.owasp:dependency-check-cli (Maven) Fixed in 9.0.6 Advisory →
  • Fix · GHSA-qqhq-8r2c-c3f5 org.owasp:dependency-check-maven (Maven) Fixed in 9.0.6 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-qqhq-8r2c-c3f5

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences