{"id":"CVE-2024-23686","aliases":["EUVD-2024-0347","GHSA-frxm-v7q3-v2wv","GHSA-qqhq-8r2c-c3f5"],"status":"published","title":"DependencyCheck Debug Mode Logging of NVD API Key","description":"DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00603,"percentile":0.4914,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2023-12-15T23:43:30Z","modified":"2026-11-08T14:00:02Z","fixes":[{"ecosystem":"Maven","package":"org.owasp:dependency-check-ant","fixed_in":["9.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.owasp:dependency-check-cli","fixed_in":["9.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.owasp:dependency-check-maven","fixed_in":["9.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.owasp:dependency-check-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.owasp:dependency-check-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.owasp:dependency-check-maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.owasp:dependency-check-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"last_affected":"9.0.5"},{"fixed":"9.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.owasp:dependency-check-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"last_affected":"9.0.5"},{"fixed":"9.0.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.owasp:dependency-check-maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.owasp:dependency-check-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}],"versions":["9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.owasp:dependency-check-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}],"versions":["9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.owasp:dependency-check-maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}],"versions":["9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.owasp:dependency-check-ant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}],"versions":["9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.owasp:dependency-check-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}],"versions":["9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5"]},{"source":"osv","ecosystem":"Maven","package":"org.owasp:dependency-check-maven","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}]}],"versions":["9.0.0","9.0.1","9.0.2","9.0.3","9.0.4","9.0.5"]}],"products":[{"vendor":"owasp","product":"dependency-check"}],"references":[{"url":"https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5","tags":["vendor-advisory","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/advisories/GHSA-qqhq-8r2c-c3f5","tags":["vendor-advisory","third-party-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5","tags":["third-party-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23686","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-frxm-v7q3-v2wv"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23686.json","tags":["advisory"]},{"url":"https://github.com/jeremylong/DependencyCheck","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-23686","title":"DependencyCheck Debug Mode Logging of NVD API Key","description":"DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.","status":"published","published":"2024-01-19T21:12:13.288Z","modified":"2026-11-08T14:00:02.156Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-532"],"updated_at":"2026-11-08T14:43:22.764053Z"}],"euvd":[{"id":"EUVD-2024-0347","description":"DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.","status":"published","published":"2024-01-19T21:12:13Z","modified":"2026-11-08T14:00:02Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-08T15:13:10.25084Z"}],"ghsa":[{"id":"GHSA-frxm-v7q3-v2wv","title":"Insertion of Sensitive Information into Log File in OWASP DependencyCheck","description":"DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.","status":"published","published":"2024-01-20T00:30:27Z","modified":"2025-06-17T19:26:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:38:47.835488Z"},{"id":"GHSA-qqhq-8r2c-c3f5","title":"nvdApiKey is logged in debug mode","description":"### Summary\nThe value of `nvdApiKey` configuration parameter is logged in clear text in debug mode.\n\n### Details\nThe NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.\nExpecting the same behavior as for several password configurations: just print `******`\n\nNote that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.\n\n### PoC\nThe nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice.\n\n### Impact\nThe NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.\n\n","status":"published","published":"2023-12-15T23:43:30Z","modified":"2024-01-22T21:14:30Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:31.550603Z"}],"nvd":[{"id":"CVE-2024-23686","description":"DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.","status":"published","published":"2024-01-19T22:15:08.437Z","modified":"2026-07-14T23:17:16.977Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"CVE-2024-23686","title":"DependencyCheck Debug Mode Logging of NVD API Key","description":"DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.","status":"published","published":"2024-01-19T21:12:13.288Z","modified":"2026-11-09T02:30:54.439539414Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"GHSA-frxm-v7q3-v2wv","title":"Insertion of Sensitive Information into Log File in OWASP DependencyCheck","description":"DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.","status":"published","published":"2024-01-20T00:30:27Z","modified":"2026-07-08T06:49:57.802404687Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:46.760785Z"},{"id":"GHSA-qqhq-8r2c-c3f5","title":"nvdApiKey is logged in debug mode","description":"### Summary\nThe value of `nvdApiKey` configuration parameter is logged in clear text in debug mode.\n\n### Details\nThe NVD API key is a kind of secret and should be treated like other secrets when logging in debug mode.\nExpecting the same behavior as for several password configurations: just print `******`\n\nNote that while the NVD API Key is an access token for the NVD API - they are not that sensitive. The only thing an NVD API Token grants is a higher rate limit when making calls to publicly available data. The data available from the NVD API is the same whether you have an API Key or not.\n\n### PoC\nThe nvdApiKey is configured to use an environment variable; when running `mvn -X dependency-check:check` the clear value is logged twice.\n\n### Impact\nThe NVD API key is a kind of secret and should not be exposed. If stolen, an attacker can use this key to obtain already public information.\n\n","status":"published","published":"2023-12-15T23:43:30Z","modified":"2026-07-08T06:49:57.802404687Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:54.760124Z"}]}}