PT-2023-31804 · Unknown · Journalpump

Docemmetbrown · Published 2023-12-20 · Updated 2024-01-02 · CVE-2023-51390

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions journalpump versions prior to 2.5.0

Description A logging issue was found in journalpump, where it logs the configuration of a service integration in plaintext to the supplied logging pipeline. This includes credential information contained in the configuration, if any.

Recommendations For versions prior to 2.5.0, update to version 2.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the logging pipeline to minimize the risk of credential exposure.

Exploit

Fix

Cleartext Transmission of Sensitive Information

Improper Access Control

Weakness Enumeration

CWE-319

CWE-284

CWE-215

Related Identifiers

CVE-2023-51390

GHSA-738V-V386-8R6G

Affected Products

Journalpump

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51390.json · Exploit
• https://github.com/Aiven-Open/journalpump/commit/390e69bc909ba16ad5f7b577010b4afc303361da · Patch
• https://github.com/Aiven-Open/journalpump/security/advisories/GHSA-738v-v386-8r6g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-51390 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51390 · Security Note
• https://twitter.com/CVEnew/status/1737618341273944147 · Twitter Post