What is GHSA-frxm-v7q3-v2wv?

GHSA-frxm-v7q3-v2wv is a security advisory published by GitHub Security Advisories with Medium severity. Insertion of Sensitive Information into Log File in OWASP DependencyCheck

Which CVE IDs does GHSA-frxm-v7q3-v2wv cover?

GHSA-frxm-v7q3-v2wv covers the following CVE IDs: CVE-2024-23686. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-frxm-v7q3-v2wv?

GHSA-frxm-v7q3-v2wv has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

Which products are affected by GHSA-frxm-v7q3-v2wv?

GHSA-frxm-v7q3-v2wv affects 3 products, including: maven/org.owasp:dependency-check-ant:\u003e= 9.0.0, \u003c 9.0.6; maven/org.owasp:dependency-check-cli:\u003e= 9.0.0, \u003c 9.0.6; maven/org.owasp:dependency-check-maven:\u003e= 9.0.0, \u003c 9.0.6.

GHSA-frxm-v7q3-v2wvMediumCVSS 5.3

Insertion of Sensitive Information into Log File in OWASP DependencyCheck

Vendor

GitHub Security Advisories

Published

January 20, 2024

Last Modified

June 17, 2025

🔗 CVE IDs covered (1)

CVE-2024-23686 →

📋 Description

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

🎯 Affected products3

maven/org.owasp:dependency-check-ant:>= 9.0.0, < 9.0.6
maven/org.owasp:dependency-check-cli:>= 9.0.0, < 9.0.6
maven/org.owasp:dependency-check-maven:>= 9.0.0, < 9.0.6

🔗 References (5)

https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5
https://nvd.nist.gov/vuln/detail/CVE-2024-23686
https://github.com/advisories/GHSA-qqhq-8r2c-c3f5
https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5
https://github.com/advisories/GHSA-frxm-v7q3-v2wv