CWE-532

{
  "affected": [],
  "aliases": [
    "CVE-2021-37759"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-07-31T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "A Session ID leak in the DEBUG log file in Graylog before 4.1.2 allows attackers to escalate privileges (to the access level of the leaked session ID).",
  "id": "GHSA-f9j4-c45h-7xwv",
  "modified": "2022-05-24T19:09:28Z",
  "published": "2022-05-24T19:09:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37759"
    },
    {
      "type": "WEB",
      "url": "https://www.graylog.org/post/announcing-graylog-v4-1-2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-43517"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-12T21:15:56Z",
    "severity": "LOW"
  },
  "details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.8.3, macOS Sequoia 15.7.3. An app may be able to access protected user data.",
  "id": "GHSA-f9j9-m66j-c8p5",
  "modified": "2025-12-17T21:30:43Z",
  "published": "2025-12-12T21:31:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43517"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/125886"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/125887"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/125888"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-37205"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-10T18:15:04Z",
    "severity": "MODERATE"
  },
  "details": "Insertion of Sensitive Information into Log File vulnerability in SERVIT Software Solutions.This issue affects affiliate-toolkit: from n/a through 3.4.4.",
  "id": "GHSA-f9wm-g526-8xc9",
  "modified": "2024-07-10T18:32:18Z",
  "published": "2024-07-10T18:32:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-37205"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/affiliate-toolkit-starter/wordpress-affiliate-toolkit-plugin-3-4-4-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-6746"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-21T21:15:14Z",
    "severity": "HIGH"
  },
  "details": "An insertion of sensitive information into log file vulnerability was identified in the log files for a GitHub Enterprise Server back-end service that could permit an `adversary in the middle attack` when combined with other phishing techniques. To exploit this, an attacker would need access to the log files for the GitHub Enterprise Server appliance, a backup archive created with GitHub Enterprise Server Backup Utilities, or a service which received streamed logs.\u00a0This vulnerability affected all versions of GitHub Enterprise Server since 3.7 and was fixed in version 3.17.19, 3.8.12, 3.9.7, 3.10.4, and 3.11.1.\u00a0",
  "id": "GHSA-fc6j-9f2x-v9w8",
  "modified": "2024-01-10T18:30:24Z",
  "published": "2023-12-21T21:30:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-6746"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.10/admin/release-notes#3.10.4"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.11/admin/release-notes#3.11.1"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.7/admin/release-notes#3.7.19"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.8/admin/release-notes#3.8.12"
    },
    {
      "type": "WEB",
      "url": "https://docs.github.com/en/enterprise-server@3.9/admin/release-notes#3.9.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-40694"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-07T21:15:08Z",
    "severity": "MODERATE"
  },
  "details": "IBM Watson CP4D Data Stores 4.0.0 through 4.8.4 stores potentially sensitive information in log files that could be read by a local user.  IBM X-Force ID:  264838.",
  "id": "GHSA-fc6m-c8v2-74q6",
  "modified": "2024-05-07T21:31:45Z",
  "published": "2024-05-07T21:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40694"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/264838"
    },
    {
      "type": "WEB",
      "url": "https://www.ibm.com/support/pages/node/7150286"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "5.0.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-45809"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-425",
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-19T15:50:58Z",
    "nvd_published_at": "2023-10-19T19:15:15Z",
    "severity": "LOW"
  },
  "details": "### Impact\n\nA user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user accounts, and by modifying URL parameters, the user can retrieve the display name for any user. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.\n\n### Patches\nPatched versions have been released as Wagtail 4.1.9 (LTS), 5.0.5 and 5.1.3. The fix is also included in Release Candidate 1 of the forthcoming Wagtail 5.2 release.\n\n### Workarounds\nNone.\n\n### Acknowledgements\nMany thanks to @quyenheu for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail\u0027s [support channels](https://docs.wagtail.io/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).",
  "id": "GHSA-fc75-58r8-rm3h",
  "modified": "2023-10-19T15:50:58Z",
  "published": "2023-10-19T15:50:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-fc75-58r8-rm3h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45809"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/0bacd29473107d9d7f5b723a15a683449679756d"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/2231f462c75dfe84307fb40577e8c2109a23b27e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/bc96aed6ac53f998b2f4c4bf97e2d4f5fe337e5b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/wagtail/PYSEC-2023-219.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wagtail/wagtail"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v4.1.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v5.0.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v5.1.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Wagtail vulnerable to disclosure of user names via admin bulk action views"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/cloudnativelabs/kube-router/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.7.0"
            },
            {
              "last_affected": "2.8.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-08T00:07:53Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nWhen kube-router is configured with per-node BGP peer passwords using the `kube-router.io/peer.passwords` node annotation, and verbose logging is enabled (`--v=2` or higher), the raw Kubernetes node annotation map is logged verbatim \u2014 including the base64-encoded BGP MD5 passwords. Anyone with access to kube-router\u0027s logs (via `kubectl logs`, log aggregation systems, or shared log dumps during debugging) can extract and decode the BGP peer passwords. The official troubleshooting documentation instructs users to collect logs at `-v=2` before filing issues, making accidental disclosure during support interactions a realistic scenario.\n\n## Details\n\nThe vulnerability is at `pkg/controllers/routing/network_routes_controller.go:1129`:\n\n```go\n// pkg/controllers/routing/network_routes_controller.go:1127-1133\n// If the global routing peer is configured then peer with it\n// else attempt to get peers from node specific BGP annotations.\nif len(nrc.globalPeerRouters) == 0 {\n    klog.V(2).Infof(\"Attempting to construct peer configs from annotation: %+v\", node.Annotations)\n    peerCfgs, err := bgpPeerConfigsFromAnnotations(\n```\n\n`node.Annotations` is of type `map[string]string`. This type does not implement `fmt.Stringer`, so `%+v` formatting dumps every key-value pair verbatim. When `kube-router.io/peer.passwords` is set on the node (the documented mechanism for providing per-node BGP MD5 passwords), its base64-encoded value appears in the log output.\n\nThe BGP peer password annotation is documented in `docs/user-guide.md` and has the constant:\n\n```go\n// pkg/controllers/routing/network_routes_controller.go:59\npeerPasswordAnnotation = \"kube-router.io/peer.passwords\"\n```\n\nNote that a password-safe `String()` method exists on `PeerConfig` and `PeerConfigs` in `pkg/bgp/peer_config.go` and is tested:\n\n```go\n// pkg/bgp/peer_config.go:63-79\n// Custom Stringer to prevent leaking passwords when printed\nfunc (p PeerConfig) String() string {\n    // ...password field is intentionally omitted...\n}\n```\n\nHowever, this protective method is never invoked by the vulnerable log statement, which dumps the raw annotation map before any parsing occurs. The password masking only applies after the annotation is parsed into `PeerConfig` structs.\n\nThe second log statement at line 1510 (`klog.Infof(\"Peer config from %s annotation: %+v\", peersAnnotation, peerConfigs)`) is **not vulnerable** \u2014 `peerConfigs` is of type `bgp.PeerConfigs` which implements `fmt.Stringer` and correctly masks passwords.\n\nThe vulnerable path (`bgpPeerConfigsFromIndividualAnnotations`) is triggered when the `kube-router.io/peers` consolidated YAML annotation is not set \u2014 i.e., when operators use the older individual annotation format (`kube-router.io/peer.ips`, `kube-router.io/peer.asns`, `kube-router.io/peer.passwords`). This older format remains fully supported and documented.\n\n## PoC\n\n**Setup**: Node has per-node BGP peer annotations including a password:\n```bash\nkubectl annotate node worker-1 \\\n  kube-router.io/peer.ips=192.0.2.1 \\\n  kube-router.io/peer.asns=65001 \\\n  \"kube-router.io/peer.passwords=$(echo -n \u0027s3cr3t-bgp-p@ss\u0027 | base64)\"\n```\n\n**Trigger**: Start kube-router with verbose logging (e.g., following troubleshooting documentation):\n```bash\n# As documented in docs/troubleshoot.md for debugging:\nkube-router ... --v=2\n```\n\n**Observe**: In kube-router pod logs:\n```\nI0318 10:23:41.123456 1 network_routes_controller.go:1129] Attempting to construct peer configs from annotation:\nmap[\n  kube-router.io/peer.asns:65001\n  kube-router.io/peer.ips:192.0.2.1\n  kube-router.io/peer.passwords:czNjcjN0LWJncC1wQHNz   \u003c-- base64-encoded password\n  ...other annotations...\n]\n```\n\n**Decode the password**:\n```bash\necho \"czNjcjN0LWJncC1wQHNz\" | base64 -d\n# Output: s3cr3t-bgp-p@ss\n```\n\n**Impact**: With the decoded password and network adjacency to the BGP peer, an attacker can establish an unauthorized BGP session, inject routes, or disrupt legitimate BGP peering.\n\n## Impact\n\n- **BGP credential disclosure**: BGP MD5 authentication passwords are exposed to anyone with access to kube-router log output\n- **BGP session hijacking**: An attacker who obtains the password and has network-level access to a BGP neighbor can impersonate the kube-router node, injecting malicious routes into the BGP table\n- **Log forwarding risk**: Log aggregation systems (Fluentd, Loki, Elastic, Splunk) typically have different and often broader access controls than Kubernetes RBAC. Passwords aggregated into these systems may be accessible to personnel without Kubernetes node access\n- **Support workflow exposure**: The official troubleshooting documentation recommends collecting `--v=2` logs before filing issues, creating a realistic path for passwords to be shared in bug reports or support tickets\n\n## Recommended Fix\n\nRemove or redact the vulnerable log statement at line 1129. The diagnostic information it provides (confirming that annotation-based peer configuration is being used) can be conveyed without exposing credential values:\n\n```go\n// Before (vulnerable):\nklog.V(2).Infof(\"Attempting to construct peer configs from annotation: %+v\", node.Annotations)\n\n// After (safe):\nklog.V(2).Infof(\"Attempting to construct peer configs from per-node annotations (kube-router.io/peer.ips, etc.)\")\n```\n\nIf full annotation content is needed for debugging (e.g., to show non-sensitive annotations), log a filtered version that explicitly excludes the password annotation:\n\n```go\n// Safe alternative that preserves non-sensitive diagnostic info:\nsafeAnnotations := make(map[string]string)\nfor k, v := range node.Annotations {\n    if k != peerPasswordAnnotation {\n        safeAnnotations[k] = v\n    }\n}\nklog.V(2).Infof(\"Attempting to construct peer configs from annotations: %+v\", safeAnnotations)\n```",
  "id": "GHSA-fcmh-qfxc-w685",
  "modified": "2026-04-08T00:07:53Z",
  "published": "2026-04-08T00:07:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cloudnativelabs/kube-router/security/advisories/GHSA-fcmh-qfxc-w685"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cloudnativelabs/kube-router"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-3716"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-03-13T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "RSA Archer versions, prior to 6.5 SP2, contain an information exposure vulnerability. The database connection password may get logged in plain text in the RSA Archer log files. An authenticated malicious local user with access to the log files may obtain the exposed password to use it in further attacks.",
  "id": "GHSA-fcpf-28p8-7vxv",
  "modified": "2022-05-13T01:22:27Z",
  "published": "2022-05-13T01:22:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3716"
    },
    {
      "type": "WEB",
      "url": "https://seclists.org/fulldisclosure/2019/Mar/19"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/107406"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-17396"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-15T21:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "In the PowerSchool Mobile application 1.1.8 for Android, the username and password are stored in the log during authentication, and may be available to attackers via logcat.",
  "id": "GHSA-fcw8-c2xc-6rfj",
  "modified": "2024-04-04T02:26:32Z",
  "published": "2022-05-24T16:58:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17396"
    },
    {
      "type": "WEB",
      "url": "https://pastebin.com/9VBiRpAR"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-47570"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-09T18:15:47Z",
    "severity": "MODERATE"
  },
  "details": "An insertion of sensitive information into log file vulnerability [CWE-532] in FortiOS 7.4.0 through 7.4.3, 7.2.0 through 7.2.7, 7.0 all versions; FortiProxy 7.4.0 through 7.4.3, 7.2.0 through 7.2.11; FortiPAM 1.4 all versions, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions and FortiSRA 1.4 all versions may allow a read-only administrator to retrieve API tokens of other administrators via observing REST API logs, if REST API logging is enabled (non-default configuration).",
  "id": "GHSA-fgjc-2w92-q899",
  "modified": "2025-12-09T18:30:44Z",
  "published": "2025-12-09T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47570"
    },
    {
      "type": "WEB",
      "url": "https://fortiguard.fortinet.com/psirt/FG-IR-24-268"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}