CVE-2022-39351: falha de média gravidade em DependencyTrack dependency-track
Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.4epss 0.2%
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit log in clear text. Actors with access to the audit log can exploit this flaw to gain access to valid API keys. The issue has been fixed in Dependency-Track 4.6.0. Instead of logging the entire API key, only the last 4 characters of the key will be logged. It is strongly recommended to check historic logs for occurrences of this behavior, and re-generating API keys in case of leakage.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
DependencyTrack · dependency-trackCVEs relacionadas — DependencyTrack dependency-track
No mesmo produto, das mais perigosas para as menos.
CVE-2024-54002MEDIUMDependency-Track allows enumeration of managed users via /api/v1/user/login endpointEPSS 0.3%CVE-2025-61776MEDIUMDependency-Track possibly discloses private NuGet repository credentials to api.nuget.orgEPSS 0.3%CVE-2025-27137MEDIUMDependency-Track vulnerable to local file inclusion via custom notification templatesEPSS 0.2%