CVE-2024-23686mediumCWE-532

CVE-2024-23686: medium-severity vulnerability in org.owasp:dependency-check-ant

DependencyCheck Debug Mode Logging of NVD API Key

Published 19 Jan 2024 · Updated 14 Jul 2026

Follow this CVE + Monitor org.owasp:dependency-check-ant + Monitor org.owasp:dependency-check-cli

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

org.owasp:dependency-check-antorg.owasp:dependency-check-cliorg.owasp:dependency-check-maven

References

https://github.com/advisories/GHSA-qqhq-8r2c-c3f5 https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5 https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5