Common Weakness Enumeration
CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1745 vulnerabilities reference this CWE, most recent first.
GHSA-8JMQ-M9FV-QR74
Vulnerability from github – Published: 2022-05-14 02:59 – Updated: 2022-05-14 02:59
VLAI
Details
An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information (private information such as location of enrolled devices, cleartext passwords, patching level, etc.) via a GET request on port 8022, 8443, or 8444.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-11716"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-16T14:29:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Zoho ManageEngine Desktop Central before 100230. There is unauthenticated remote access to all log files of a Desktop Central instance containing critical information (private information such as location of enrolled devices, cleartext passwords, patching level, etc.) via a GET request on port 8022, 8443, or 8444.",
"id": "GHSA-8jmq-m9fv-qr74",
"modified": "2022-05-14T02:59:22Z",
"published": "2022-05-14T02:59:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11716"
},
{
"type": "WEB",
"url": "https://blog.netxp.fr/manageengine-deep-exploitation"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/desktop-central/vulnerability-in-log-files.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8JPP-7P79-W764
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2024-04-04 01:00
VLAI
Details
Cloud Foundry BOSH 267.x versions prior to v267.14.0, and BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2019-11271"
],
"database_specific": {
"cwe_ids": [
"CWE-522",
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-19T00:15:00Z",
"severity": "HIGH"
},
"details": "Cloud Foundry BOSH 267.x versions prior to v267.14.0, and BOSH 270.x versions prior to v270.1.1, contain a BOSH Director that does not properly redact credentials when configured to use a MySQL database. A local authenticated malicious user may read any credentials that are contained in a BOSH manifest.",
"id": "GHSA-8jpp-7p79-w764",
"modified": "2024-04-04T01:00:59Z",
"published": "2022-05-24T16:48:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11271"
},
{
"type": "WEB",
"url": "https://www.cloudfoundry.org/blog/cve-2019-11271"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8M88-R8CJ-F72F
Vulnerability from github – Published: 2022-12-19 21:30 – Updated: 2022-12-23 21:30
VLAI
Details
IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-43887"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-19T21:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain sensitive information, it could lead to further attacks. IBM X-Force ID: 240450.",
"id": "GHSA-8m88-r8cj-f72f",
"modified": "2022-12-23T21:30:19Z",
"published": "2022-12-19T21:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-43887"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/240450"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6841801"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8MJG-8C8G-6H85
Vulnerability from github – Published: 2023-02-06 23:27 – Updated: 2024-05-20 19:26
VLAI
Summary
Kubernetes Sensitive Information leak via Log File
Details
In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.
Severity
4.7 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/kubernetes/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.19.0"
},
{
"fixed": "1.19.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/kubernetes/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "1.18.0"
},
{
"fixed": "1.18.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/kubernetes/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.20.0-alpha.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-8564"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-06T23:27:00Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects \u003c v1.19.3, \u003c v1.18.10, \u003c v1.17.13.",
"id": "GHSA-8mjg-8c8g-6h85",
"modified": "2024-05-20T19:26:49Z",
"published": "2023-02-06T23:27:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8564"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/95622"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/94712"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/commit/11793434dac97a49bfed0150b56ac63e5dc34634"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/kubernetes"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2021-0066"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210122-0006"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Kubernetes Sensitive Information leak via Log File"
}
GHSA-8P36-QQPP-QH28
Vulnerability from github – Published: 2025-11-11 18:30 – Updated: 2025-11-11 18:30
VLAI
Details
Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-62208"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T18:15:47Z",
"severity": "MODERATE"
},
"details": "Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.",
"id": "GHSA-8p36-qqpp-qh28",
"modified": "2025-11-11T18:30:23Z",
"published": "2025-11-11T18:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62208"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62208"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8P78-MRGJ-HW73
Vulnerability from github – Published: 2024-06-06 00:30 – Updated: 2024-07-18 21:30
VLAI
Details
Under certain circumstances the Microsoft® Internet Information Server (IIS) used to host the C•CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C•CURE 9000 or prior versions
Severity
{
"affected": [],
"aliases": [
"CVE-2024-0912"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-06T00:15:09Z",
"severity": "HIGH"
},
"details": "Under certain circumstances the Microsoft\u00ae Internet Information Server (IIS) used to host the C\u2022CURE 9000 Web Server will log Microsoft Windows credential details within logs. There is no impact to non-web service interfaces C\u2022CURE 9000 or prior versions",
"id": "GHSA-8p78-mrgj-hw73",
"modified": "2024-07-18T21:30:36Z",
"published": "2024-06-06T00:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-0912"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-135-03"
},
{
"type": "WEB",
"url": "https://www.johnsoncontrols.com/-/media/jci/cyber-solutions/product-security-advisories/2024/jci-psa-2024-04.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8P8H-W59Q-XF45
Vulnerability from github – Published: 2024-02-21 00:31 – Updated: 2024-09-04 18:30
VLAI
Details
An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.log file.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-23758"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-20T23:15:07Z",
"severity": "HIGH"
},
"details": "An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.log file.",
"id": "GHSA-8p8h-w59q-xf45",
"modified": "2024-09-04T18:30:48Z",
"published": "2024-02-21T00:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23758"
},
{
"type": "WEB",
"url": "https://public.support.unisys.com/common/public/vulnerability/NVD_Detail_Rpt.aspx?ID=70"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8PC2-WCC6-JG3P
Vulnerability from github – Published: 2023-07-19 03:30 – Updated: 2024-04-04 06:16
VLAI
Details
Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896.
Severity
6.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-26023"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-19T02:15:09Z",
"severity": "HIGH"
},
"details": "Planning Analytics Cartridge for Cloud Pak for Data 4.0 exposes sensitive information in logs which could lead an attacker to exploit this vulnerability to conduct further attacks. IBM X-Force ID: 247896.",
"id": "GHSA-8pc2-wcc6-jg3p",
"modified": "2024-04-04T06:16:51Z",
"published": "2023-07-19T03:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26023"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/247896"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6999351"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8PC7-RGGG-XW6R
Vulnerability from github – Published: 2022-05-17 03:40 – Updated: 2022-05-17 03:40
VLAI
Details
The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.
Severity
{
"affected": [],
"aliases": [
"CVE-2016-5432"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-10-03T18:59:00Z",
"severity": "LOW"
},
"details": "The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning information by reading log files.",
"id": "GHSA-8pc7-rggg-xw6r",
"modified": "2022-05-17T03:40:37Z",
"published": "2022-05-17T03:40:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5432"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2016:1967"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2016-5432"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1371428"
},
{
"type": "WEB",
"url": "https://gerrit.ovirt.org/#/q/I40c88ad48f8f7c2b8e06802137870b0c198b5129"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1967.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/92694"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8QP7-FHR9-FW53
Vulnerability from github – Published: 2026-03-05 00:23 – Updated: 2026-03-09 15:46
VLAI
Summary
@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass
Details
Impact
A malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs.
The attack requires: - The ability to register a template in the catalog - A victim who executes the malicious template
Patches
Patched in @backstage/plugin-scaffolder-backend version 3.1.4
Workarounds
- Implement a custom permission policy that restricts scaffolder.task.read so users can only read their own task logs
- Restrict who can register templates in the catalog to trusted users only
Resources
- Backstage Scaffolder permissions documentation: https://backstage.io/docs/permissions/plugin-authors/01-setup/
- Backstage Threat Model: https://backstage.io/docs/overview/threat-model/
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.3"
},
"package": {
"ecosystem": "npm",
"name": "@backstage/plugin-scaffolder-backend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-29184"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-05T00:23:51Z",
"nvd_published_at": "2026-03-07T15:15:55Z",
"severity": "LOW"
},
"details": "### Impact\n\nA malicious scaffolder template can bypass the log redaction mechanism to exfiltrate secrets provided run through task event logs.\n\nThe attack requires:\n - The ability to register a template in the catalog\n - A victim who executes the malicious template\n\n### Patches\n Patched in `@backstage/plugin-scaffolder-backend` version 3.1.4\n\n### Workarounds\n - Implement a custom permission policy that restricts scaffolder.task.read so users can only read their own task logs\n - Restrict who can register templates in the catalog to trusted users only\n\n### Resources\n - Backstage Scaffolder permissions documentation: https://backstage.io/docs/permissions/plugin-authors/01-setup/\n - Backstage Threat Model: https://backstage.io/docs/overview/threat-model/",
"id": "GHSA-8qp7-fhr9-fw53",
"modified": "2026-03-09T15:46:58Z",
"published": "2026-03-05T00:23:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/backstage/backstage/security/advisories/GHSA-8qp7-fhr9-fw53"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29184"
},
{
"type": "WEB",
"url": "https://backstage.io/docs/overview/threat-model"
},
{
"type": "WEB",
"url": "https://backstage.io/docs/permissions/plugin-authors/01-setup"
},
{
"type": "PACKAGE",
"url": "https://github.com/backstage/backstage"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass"
}
Mitigation
Architecture and Design
Implementation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Distribution
Remove debug log files before deploying the application into production.
Mitigation
Operation
Protect log files against unauthorized read/write.
Mitigation
Implementation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.