PT-2023-31804 · Unknown · Journalpump

Docemmetbrown · Publicado 2023-12-20 · Atualizado 2024-01-02 · CVE-2023-51390

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions journalpump versions prior to 2.5.0

Description A logging issue was found in journalpump, where it logs the configuration of a service integration in plaintext to the supplied logging pipeline. This includes credential information contained in the configuration, if any.

Recommendations For versions prior to 2.5.0, update to version 2.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the logging pipeline to minimize the risk of credential exposure.

Exploit

Correção

Cleartext Transmission of Sensitive Information

Improper Access Control

Enumeração de Fraquezas

CWE-319

CWE-284

CWE-215

Identificadores relacionados

CVE-2023-51390

GHSA-738V-V386-8R6G

Produtos afetados

Journalpump

Referências · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51390.json · Exploit
• https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da · Correção
• https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-51390 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-51390 · Nota de Segurança
• https://twitter.com/CVEnew/status/1737618341273944147 · Publicação no Twitter