Vulnerability-Lookup

CVE-2024-32028 (GCVE-0-2024-32028)

Vulnerability from cvelistv5 – Published: 2024-04-12 22:58 – Updated: 2024-08-02 01:59

Title

Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore

Summary

OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Severity

4.1 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-23 16:21 UTC

CWE

CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
CWE-201 - Insertion of Sensitive Information Into Sent Data

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/open-telemetry/opentelemetry-d…	x_refsource_CONFIRM
https://github.com/open-telemetry/opentelemetry-d…	x_refsource_MISC
https://github.com/open-telemetry/semantic-conven…	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version	CPE status
open-telemetry	opentelemetry-dotnet	Affected: < 1.8.1	guessed
opentelemetry	opentelemetry	Affected: 0 , < 1.8.1 (custom) cpe:2.3:a:opentelemetry:opentelemetry::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "opentelemetry",
            "vendor": "opentelemetry",
            "versions": [
              {
                "lessThan": "1.8.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32028",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-23T16:21:31.026081Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-23T15:38:42.405Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:59:50.898Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f"
          },
          {
            "name": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42"
          },
          {
            "name": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "opentelemetry-dotnet",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-201",
              "description": "CWE-201: Insertion of Sensitive Information Into Sent Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-12T22:58:30.526Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f"
        },
        {
          "name": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42"
        },
        {
          "name": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md"
        }
      ],
      "source": {
        "advisory": "GHSA-vh2m-22xx-q94f",
        "discovery": "UNKNOWN"
      },
      "title": "Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-32028",
    "datePublished": "2024-04-12T22:58:30.526Z",
    "dateReserved": "2024-04-09T15:29:35.938Z",
    "dateUpdated": "2024-08-02T01:59:50.898Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-32028",
      "date": "2026-09-16",
      "epss": "0.00291",
      "percentile": "0.21724"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability.\"}, {\"lang\": \"es\", \"value\": \"OpenTelemetry dotnet es un framework de telemetr\\u00eda dotnet. En las versiones afectadas de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore`, `url.full` escribe atributos/etiquetas en intervalos (`Activity`) cuando el rastreo est\\u00e1 habilitado para solicitudes http salientes y `OpenTelemetry.Instrumentation. AspNetCore` escribe el atributo/etiqueta `url.query` en intervalos (`Actividad`) cuando el seguimiento est\\u00e1 habilitado para solicitudes http entrantes. Estos atributos est\\u00e1n definidos por las convenciones sem\\u00e1nticas para intervalos HTTP. Hasta la versi\\u00f3n `1.8.1`, los valores escritos por `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pasar\\u00e1n a trav\\u00e9s de la cadena de consulta sin formato tal como se envi\\u00f3 o recibi\\u00f3 (respectivamente). Esto puede dar lugar a que se filtre informaci\\u00f3n confidencial (por ejemplo, EUII: informaci\\u00f3n identificable del usuario final, credenciales, etc.) a los servidores de telemetr\\u00eda (dependiendo de las aplicaciones que se instrumenten), lo que podr\\u00eda causar incidentes de privacidad y/o seguridad. Nota: Las versiones anteriores de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pueden usar nombres de etiquetas diferentes pero tienen la misma vulnerabilidad. Las versiones `1.8.1` de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` ahora redactar\\u00e1n de forma predeterminada todos los valores detectados en las cadenas de consulta transmitidas o recibidas. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.\"}]",
      "id": "CVE-2024-32028",
      "lastModified": "2024-11-21T09:14:21.583",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\", \"baseScore\": 4.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"ADJACENT_NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.3, \"impactScore\": 1.4}]}",
      "published": "2024-04-12T23:15:06.643",
      "references": "[{\"url\": \"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-201\"}, {\"lang\": \"en\", \"value\": \"CWE-212\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-32028\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-04-12T23:15:06.643\",\"lastModified\":\"2026-06-17T07:29:08.987\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability.\"},{\"lang\":\"es\",\"value\":\"OpenTelemetry dotnet es un framework de telemetr\u00eda dotnet. En las versiones afectadas de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore`, `url.full` escribe atributos/etiquetas en intervalos (`Activity`) cuando el rastreo est\u00e1 habilitado para solicitudes http salientes y `OpenTelemetry.Instrumentation. AspNetCore` escribe el atributo/etiqueta `url.query` en intervalos (`Actividad`) cuando el seguimiento est\u00e1 habilitado para solicitudes http entrantes. Estos atributos est\u00e1n definidos por las convenciones sem\u00e1nticas para intervalos HTTP. Hasta la versi\u00f3n `1.8.1`, los valores escritos por `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pasar\u00e1n a trav\u00e9s de la cadena de consulta sin formato tal como se envi\u00f3 o recibi\u00f3 (respectivamente). Esto puede dar lugar a que se filtre informaci\u00f3n confidencial (por ejemplo, EUII: informaci\u00f3n identificable del usuario final, credenciales, etc.) a los servidores de telemetr\u00eda (dependiendo de las aplicaciones que se instrumenten), lo que podr\u00eda causar incidentes de privacidad y/o seguridad. Nota: Las versiones anteriores de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pueden usar nombres de etiquetas diferentes pero tienen la misma vulnerabilidad. Las versiones `1.8.1` de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` ahora redactar\u00e1n de forma predeterminada todos los valores detectados en las cadenas de consulta transmitidas o recibidas. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"open-telemetry\",\"product\":\"opentelemetry-dotnet\",\"versions\":[{\"version\":\"\u003c 1.8.1\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"opentelemetry\",\"product\":\"opentelemetry\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.8.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\",\"baseScore\":4.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-23T16:21:31.026081Z\",\"id\":\"CVE-2024-32028\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-201\"},{\"lang\":\"en\",\"value\":\"CWE-212\"}]}],\"references\":[{\"url\":\"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T21:37:31+00:00",
      "cve": "CVE-2024-32028",
      "id": "CVE-2024-32028",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-32028.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f\", \"name\": \"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}, {\"url\": \"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42\", \"name\": \"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}, {\"url\": \"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md\", \"name\": \"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T01:59:50.898Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-32028\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-23T16:21:31.026081Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:*\"], \"vendor\": \"opentelemetry\", \"product\": \"opentelemetry\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.8.1\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-04-23T16:18:01.933Z\"}}], \"cna\": {\"title\": \"Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore\", \"source\": {\"advisory\": \"GHSA-vh2m-22xx-q94f\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.1, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"vendor\": \"open-telemetry\", \"product\": \"opentelemetry-dotnet\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.8.1\"}]}], \"references\": [{\"url\": \"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f\", \"name\": \"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42\", \"name\": \"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md\", \"name\": \"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-212\", \"description\": \"CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-201\", \"description\": \"CWE-201: Insertion of Sensitive Information Into Sent Data\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-04-12T22:58:30.526Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-32028\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T01:59:50.898Z\", \"dateReserved\": \"2024-04-09T15:29:35.938Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-04-12T22:58:30.526Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-32028

Vulnerability from fkie_nvd - Published: 2024-04-12 23:15 - Updated: 2026-06-17 07:29

Severity

4.1 (Medium) - CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42
	security-advisories@github.com	https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f
	security-advisories@github.com	https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "opentelemetry-dotnet",
          "vendor": "open-telemetry",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.8.1"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "opentelemetry",
          "vendor": "opentelemetry",
          "versions": [
            {
              "lessThan": "1.8.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability."
    },
    {
      "lang": "es",
      "value": "OpenTelemetry dotnet es un framework de telemetr\u00eda dotnet. En las versiones afectadas de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore`, `url.full` escribe atributos/etiquetas en intervalos (`Activity`) cuando el rastreo est\u00e1 habilitado para solicitudes http salientes y `OpenTelemetry.Instrumentation. AspNetCore` escribe el atributo/etiqueta `url.query` en intervalos (`Actividad`) cuando el seguimiento est\u00e1 habilitado para solicitudes http entrantes. Estos atributos est\u00e1n definidos por las convenciones sem\u00e1nticas para intervalos HTTP. Hasta la versi\u00f3n `1.8.1`, los valores escritos por `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pasar\u00e1n a trav\u00e9s de la cadena de consulta sin formato tal como se envi\u00f3 o recibi\u00f3 (respectivamente). Esto puede dar lugar a que se filtre informaci\u00f3n confidencial (por ejemplo, EUII: informaci\u00f3n identificable del usuario final, credenciales, etc.) a los servidores de telemetr\u00eda (dependiendo de las aplicaciones que se instrumenten), lo que podr\u00eda causar incidentes de privacidad y/o seguridad. Nota: Las versiones anteriores de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pueden usar nombres de etiquetas diferentes pero tienen la misma vulnerabilidad. Las versiones `1.8.1` de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` ahora redactar\u00e1n de forma predeterminada todos los valores detectados en las cadenas de consulta transmitidas o recibidas. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
    }
  ],
  "id": "CVE-2024-32028",
  "lastModified": "2026-06-17T07:29:08.987",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-32028",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-04-23T16:21:31.026081Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-04-12T23:15:06.643",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        },
        {
          "lang": "en",
          "value": "CWE-212"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VH2M-22XX-Q94F

Vulnerability from github – Published: 2024-04-12 22:54 – Updated: 2024-04-15 19:41

Summary

Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore

Details

Impact

OpenTelemetry.Instrumentation.Http writes the url.full attribute/tag on spans (Activity) when tracing is enabled for outgoing http requests and OpenTelemetry.Instrumentation.AspNetCore writes the url.query attribute/tag on spans (Activity) when tracing is enabled for incoming http requests.

These attributes are defined by the Semantic Conventions for HTTP Spans.

Up until the 1.8.1 the values written by OpenTelemetry.Instrumentation.Http & OpenTelemetry.Instrumentation.AspNetCore will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents.

Note: Older versions of OpenTelemetry.Instrumentation.Http & OpenTelemetry.Instrumentation.AspNetCore may use different tag names but have the same vulnerability.

Resolution

The 1.8.1 versions of OpenTelemetry.Instrumentation.Http & OpenTelemetry.Instrumentation.AspNetCore will now redact by default all values detected on transmitted or received query strings.

Example transmitted or received query sting:

?key1=value1&key2=value2

Example of redacted value written on telemetry:

?key1=Redacted&key2=Redacted

Severity

4.1 (Medium)


                  
                    CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "OpenTelemetry.Instrumentation.Http"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "OpenTelemetry.Instrumentation.AspNetCore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32028"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-201",
      "CWE-212"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-12T22:54:09Z",
    "nvd_published_at": "2024-04-12T23:15:06Z",
    "severity": "MODERATE"
  },
  "details": "## Impact\n\n`OpenTelemetry.Instrumentation.Http` writes the `url.full` attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests.\n\nThese attributes are defined by the [Semantic Conventions for HTTP Spans](https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md).\n\nUp until the `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents.\n\nNote: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability.\n\n## Resolution\n\nThe `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings.\n\nExample transmitted or received query sting:\n\n`?key1=value1\u0026key2=value2`\n\nExample of redacted value written on telemetry:\n\n`?key1=Redacted\u0026key2=Redacted`",
  "id": "GHSA-vh2m-22xx-q94f",
  "modified": "2024-04-15T19:41:05Z",
  "published": "2024-04-12T22:54:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32028"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open-telemetry/opentelemetry-dotnet"
    },
    {
      "type": "WEB",
      "url": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore"
}

GSD-2024-32028

Vulnerability from gsd - Updated: 2024-04-11 05:03

Details

Aliases

CVE-2024-32028

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-32028"
      ],
      "details": "OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
      "id": "GSD-2024-32028",
      "modified": "2024-04-11T05:03:18.984373Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2024-32028",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "opentelemetry-dotnet",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "\u003c 1.8.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "open-telemetry"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-212",
                "lang": "eng",
                "value": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-201",
                "lang": "eng",
                "value": "CWE-201: Insertion of Sensitive Information Into Sent Data"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f",
            "refsource": "MISC",
            "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f"
          },
          {
            "name": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42",
            "refsource": "MISC",
            "url": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42"
          },
          {
            "name": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md",
            "refsource": "MISC",
            "url": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-vh2m-22xx-q94f",
        "discovery": "UNKNOWN"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` \u0026 `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability."
          },
          {
            "lang": "es",
            "value": "OpenTelemetry dotnet es un framework de telemetr\u00eda dotnet. En las versiones afectadas de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore`, `url.full` escribe atributos/etiquetas en intervalos (`Activity`) cuando el rastreo est\u00e1 habilitado para solicitudes http salientes y `OpenTelemetry.Instrumentation. AspNetCore` escribe el atributo/etiqueta `url.query` en intervalos (`Actividad`) cuando el seguimiento est\u00e1 habilitado para solicitudes http entrantes. Estos atributos est\u00e1n definidos por las convenciones sem\u00e1nticas para intervalos HTTP. Hasta la versi\u00f3n `1.8.1`, los valores escritos por `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pasar\u00e1n a trav\u00e9s de la cadena de consulta sin formato tal como se envi\u00f3 o recibi\u00f3 (respectivamente). Esto puede dar lugar a que se filtre informaci\u00f3n confidencial (por ejemplo, EUII: informaci\u00f3n identificable del usuario final, credenciales, etc.) a los servidores de telemetr\u00eda (dependiendo de las aplicaciones que se instrumenten), lo que podr\u00eda causar incidentes de privacidad y/o seguridad. Nota: Las versiones anteriores de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pueden usar nombres de etiquetas diferentes pero tienen la misma vulnerabilidad. Las versiones `1.8.1` de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` ahora redactar\u00e1n de forma predeterminada todos los valores detectados en las cadenas de consulta transmitidas o recibidas. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."
          }
        ],
        "id": "CVE-2024-32028",
        "lastModified": "2024-04-15T13:15:31.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2024-04-12T23:15:06.643",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-201"
              },
              {
                "lang": "en",
                "value": "CWE-212"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-32028 (GCVE-0-2024-32028)

FKIE_CVE-2024-32028

GHSA-VH2M-22XX-Q94F

Impact

Resolution

GSD-2024-32028

Tags

Sightings

Nomenclature

Related by attack behaviour