PT-2022-24920 · Unknown · Dependency-Track

Elastic-Pangolin · Published 2022-10-25 · Updated 2022-10-28 · CVE-2022-39351

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dependency-Track versions prior to 4.6.0

Description The issue allows actors with access to the audit log to exploit a flaw and gain access to valid API keys. This occurs when an API request is made using a valid API key with insufficient permissions, causing the API key to be written to Dependency-Track's audit log in clear text. It is estimated that a significant number of devices may be affected, although the exact number is not specified. There is no information available about real-world incidents where this issue was exploited.

Recommendations For versions prior to 4.6.0, update to version 4.6.0 or later, where only the last 4 characters of the API key will be logged instead of the entire key. Additionally, it is recommended to check historic logs for occurrences of this behavior and re-generate API keys in case of leakage.

Exploit

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2022-39351

GHSA-GH7V-4HXP-GQP4

Affected Products

Dependency-Track

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39351.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39351 · Security Note
• https://osv.dev/vulnerability/CVE-2022-39351 · Vendor Advisory
• https://github.com/DependencyTrack/dependency-track/blob/4.5.0/src/main/docker/logback.xml · Note
• https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-gh7v-4hxp-gqp4 · Note
• https://docs.dependencytrack.org/changelog · Note