CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1961 vulnerabilities reference this CWE, most recent first.
GHSA-F6M8-CPJP-PWMJ
Vulnerability from github – Published: 2023-01-20 21:30 – Updated: 2023-01-27 15:30IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM X-Force ID: 213645.
{
"affected": [],
"aliases": [
"CVE-2021-39011"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-20T19:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.6.0 stores potentially sensitive information in log files that could be read by a privileged user. IBM X-Force ID: 213645.",
"id": "GHSA-f6m8-cpjp-pwmj",
"modified": "2023-01-27T15:30:32Z",
"published": "2023-01-20T21:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39011"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/213645"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6856403"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F6MM-5FC7-3G3C
Vulnerability from github – Published: 2024-05-15 17:17 – Updated: 2024-05-15 17:17Summary
Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment.
PoC
- Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete
$GOPATH/pkg). - Make sure to have secrets set in the environment
- Make sure to not have
go mod tidyin a before hook - Run
goreleaser release --clean - Go prints lots of
go: downloading ...lines, which triggers the "if output not empty, log it" line, which includes the environment.
Impact
Credentials and tokens are leaked.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/goreleaser/goreleaser"
},
"ranges": [
{
"events": [
{
"introduced": "1.26.0"
},
{
"fixed": "1.26.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.26.0"
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-15T17:17:10Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\nSince #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the `go build` output is non-empty, goreleaser leaks the environment.\n\n### PoC\n* Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete `$GOPATH/pkg`).\n* Make sure to have secrets set in the environment\n* Make sure to not have `go mod tidy` in a before hook\n* Run `goreleaser release --clean`\n* Go prints lots of `go: downloading ...` lines, which triggers the \"if output not empty, log it\" line, which includes the environment.\n\n### Impact\nCredentials and tokens are leaked.",
"id": "GHSA-f6mm-5fc7-3g3c",
"modified": "2024-05-15T17:17:10Z",
"published": "2024-05-15T17:17:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/goreleaser/goreleaser/security/advisories/GHSA-f6mm-5fc7-3g3c"
},
{
"type": "WEB",
"url": "https://github.com/goreleaser/goreleaser/pull/4787"
},
{
"type": "WEB",
"url": "https://github.com/goreleaser/goreleaser/commit/22f734e41f7a5111a031a3a4eb714c1b6aa6456b"
},
{
"type": "PACKAGE",
"url": "https://github.com/goreleaser/goreleaser"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "goreleaser shows environment by default"
}
GHSA-F6RF-PQGW-R55H
Vulnerability from github – Published: 2025-07-30 18:31 – Updated: 2025-07-30 18:31TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
{
"affected": [],
"aliases": [
"CVE-2025-26332"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-30T18:15:30Z",
"severity": "HIGH"
},
"details": "TechAdvisor versions 2.6 through 3.37-30 for Dell XtremIO X2, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.",
"id": "GHSA-f6rf-pqgw-r55h",
"modified": "2025-07-30T18:31:37Z",
"published": "2025-07-30T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26332"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000337241/dsa-2025-108-security-update-for-dell-emc-xtremio-x2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F6RJ-QRPF-JC34
Vulnerability from github – Published: 2022-09-01 00:00 – Updated: 2022-09-06 00:00An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.
{
"affected": [],
"aliases": [
"CVE-2022-39046"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-31T06:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in the GNU C Library (glibc) 2.36. When the syslog function is passed a crafted input string larger than 1024 bytes, it reads uninitialized memory from the heap and prints it to the target log file, potentially revealing a portion of the contents of the heap.",
"id": "GHSA-f6rj-qrpf-jc34",
"modified": "2022-09-06T00:00:28Z",
"published": "2022-09-01T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39046"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202310-03"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20221104-0002"
},
{
"type": "WEB",
"url": "https://sourceware.org/bugzilla/show_bug.cgi?id=29536"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Feb/3"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/30/6"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2024/01/30/8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F78X-X62P-G24F
Vulnerability from github – Published: 2026-09-24 21:32 – Updated: 2026-09-24 21:32Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels.
{
"affected": [],
"aliases": [
"CVE-2026-82372"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-24T20:17:32Z",
"severity": "HIGH"
},
"details": "Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels.",
"id": "GHSA-f78x-x62p-g24f",
"modified": "2026-09-24T21:32:49Z",
"published": "2026-09-24T21:32:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82372"
},
{
"type": "WEB",
"url": "https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38997"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F7W2-Q2CG-586J
Vulnerability from github – Published: 2024-04-17 09:30 – Updated: 2024-04-17 09:30A potential security vulnerability has been identified in HPE Compute Scale-up Server 3200 server. This vulnerability could cause disclosure of sensitive information in log files.
{
"affected": [],
"aliases": [
"CVE-2024-22440"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-17T07:15:08Z",
"severity": "MODERATE"
},
"details": "\nA potential security vulnerability has been identified in HPE Compute Scale-up Server 3200 server. This vulnerability could cause disclosure of sensitive information in log files.\n\n",
"id": "GHSA-f7w2-q2cg-586j",
"modified": "2024-04-17T09:30:31Z",
"published": "2024-04-17T09:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22440"
},
{
"type": "WEB",
"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbhf04634en_us\u0026docLocale=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F88M-XHWQ-GC2R
Vulnerability from github – Published: 2022-05-24 16:55 – Updated: 2024-04-04 01:49An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor management service is installed, the Windows username and password for this service are logged in cleartext to the Command_centre.log file.
{
"affected": [],
"aliases": [
"CVE-2019-15294"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-28T12:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue was discovered in Gallagher Command Centre 8.10 before 8.10.1092(MR2). Upon an upgrade, if a custom service account is in use and the visitor management service is installed, the Windows username and password for this service are logged in cleartext to the Command_centre.log file.",
"id": "GHSA-f88m-xhwq-gc2r",
"modified": "2024-04-04T01:49:57Z",
"published": "2022-05-24T16:55:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15294"
},
{
"type": "WEB",
"url": "https://security.gallagher.com/CVE-2019-15294"
},
{
"type": "WEB",
"url": "https://security.gallagher.com/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F8CC-P734-WW7F
Vulnerability from github – Published: 2022-05-13 01:48 – Updated: 2022-05-13 01:48Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file.
{
"affected": [],
"aliases": [
"CVE-2017-9615"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-26T07:29:00Z",
"severity": "CRITICAL"
},
"details": "Password exposure in Cognito Software Moneyworks 8.0.3 and earlier allows attackers to gain administrator access to all data, because verbose logging writes the administrator password to a world-readable file.",
"id": "GHSA-f8cc-p734-ww7f",
"modified": "2022-05-13T01:48:02Z",
"published": "2022-05-13T01:48:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9615"
},
{
"type": "WEB",
"url": "https://gist.github.com/ari/e0dd74c12d84f102e3bcb365118e8c30"
},
{
"type": "WEB",
"url": "http://cognito.co.nz/mwcommunity/viewtopic.php?f=1\u0026t=3542"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F92C-VMWR-RMV8
Vulnerability from github – Published: 2024-12-09 21:31 – Updated: 2024-12-09 21:31User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application.
{
"affected": [],
"aliases": [
"CVE-2024-12057"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-09T19:15:12Z",
"severity": "LOW"
},
"details": "User credentials (login \u0026 password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end.\nBy exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application.",
"id": "GHSA-f92c-vmwr-rmv8",
"modified": "2024-12-09T21:31:01Z",
"published": "2024-12-09T21:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12057"
},
{
"type": "WEB",
"url": "https://www.pcvue.com/security/#SB2024-6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:M/U:Clear",
"type": "CVSS_V4"
}
]
}
GHSA-F968-43QJ-4PG8
Vulnerability from github – Published: 2022-05-13 01:42 – Updated: 2022-05-13 01:42An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them.
{
"affected": [],
"aliases": [
"CVE-2017-11134"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-01T14:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in heinekingmedia StashCat through 1.7.5 for Android. The login credentials are written into a log file on the device. Hence, an attacker with access to the logs can read them.",
"id": "GHSA-f968-43qj-4pg8",
"modified": "2022-05-13T01:42:09Z",
"published": "2022-05-13T01:42:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11134"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2017/Jul/90"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.