CVE-2024-23686

· MEDIUMModified

← All CVEs

CVSS v3.1

5.3

EPSS

0.60%

Published

Jan 19, 2024

Modified

Nov 28, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-532CWE-532

Affected Products (3)

owasp · dependency-checkvulnerable

owasp · dependency-check (up to 9.0.6)vulnerable

References (6)

https://github.com/advisories/GHSA-qqhq-8r2c-c3f5

Third Party Advisory

https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5

Vendor Advisory

https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5

Third Party Advisory

https://github.com/advisories/GHSA-qqhq-8r2c-c3f5

Third Party Advisory

https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5

Vendor Advisory

https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs