CWE-532
AllowedInsertion of Sensitive Information into Log File
Abstraction: Base · Status: Incomplete
The product writes sensitive information to a log file.
1953 vulnerabilities reference this CWE, most recent first.
GHSA-W4RH-FGX7-Q63M
Vulnerability from github – Published: 2025-03-06 06:30 – Updated: 2025-04-09 20:12Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password.
This is only exploitable if:
1) Logging is enabled;
2) Redis is using password authentication;
3) Those logs are accessible to an attacker, who can reach that redis instance.
Note:
It is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ray"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.43.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-1979"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-06T22:31:54Z",
"nvd_published_at": "2025-03-06T05:15:16Z",
"severity": "MODERATE"
},
"details": "Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the standard logging. If the redis password is passed as an argument, it will be logged and could potentially leak the password.\n\nThis is only exploitable if:\n\n1) Logging is enabled;\n\n2) Redis is using password authentication;\n\n3) Those logs are accessible to an attacker, who can reach that redis instance.\n\n**Note:**\n\nIt is recommended that anyone who is running in this configuration should update to the latest version of Ray, then rotate their redis password.",
"id": "GHSA-w4rh-fgx7-q63m",
"modified": "2025-04-09T20:12:59Z",
"published": "2025-03-06T06:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1979"
},
{
"type": "WEB",
"url": "https://github.com/ray-project/ray/issues/50266"
},
{
"type": "WEB",
"url": "https://github.com/ray-project/ray/pull/50409"
},
{
"type": "WEB",
"url": "https://github.com/ray-project/ray/commit/64a2e4010522d60b90c389634f24df77b603d85d"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ray/PYSEC-2025-23.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/ray-project/ray"
},
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-PYTHON-RAY-8745212"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "ray vulnerable to Insertion of Sensitive Information into Log File"
}
GHSA-W56X-Q3JG-3926
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users.
{
"affected": [],
"aliases": [
"CVE-2019-9976"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-04-11T19:29:00Z",
"severity": "HIGH"
},
"details": "The Boa server configuration on DASAN H660RM devices with firmware 1.03-0022 logs POST data to the /tmp/boa-temp file, which allows logged-in users to read the credentials of administration web interface users.",
"id": "GHSA-w56x-q3jg-3926",
"modified": "2022-05-13T01:23:08Z",
"published": "2022-05-13T01:23:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9976"
},
{
"type": "WEB",
"url": "https://blog.burghardt.pl/2019/03/boa-webserver-on-dasan-h660rm-devices-with-firmware-1-03-0022-saves-post-data-including-credentials-to-tmp-boa-temp"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-W62X-QH57-5M94
Vulnerability from github – Published: 2023-04-20 00:30 – Updated: 2024-04-04 03:36Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.
{
"affected": [],
"aliases": [
"CVE-2022-2084"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-19T22:15:10Z",
"severity": "MODERATE"
},
"details": "Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed passwords.",
"id": "GHSA-w62x-qh57-5m94",
"modified": "2024-04-04T03:36:26Z",
"published": "2023-04-20T00:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2084"
},
{
"type": "WEB",
"url": "https://github.com/canonical/cloud-init/commit/4d467b14363d800b2185b89790d57871f11ea88c"
},
{
"type": "WEB",
"url": "https://ubuntu.com/security/notices/USN-5496-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6F6-8JP4-H3C2
Vulnerability from github – Published: 2024-07-02 21:32 – Updated: 2024-07-02 21:32Under certain circumstances unnecessary user details are provided within system logs
{
"affected": [],
"aliases": [
"CVE-2024-32757"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-02T14:15:12Z",
"severity": "MODERATE"
},
"details": "Under certain circumstances unnecessary user details are provided within system logs",
"id": "GHSA-w6f6-8jp4-h3c2",
"modified": "2024-07-02T21:32:14Z",
"published": "2024-07-02T21:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32757"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-179-06"
},
{
"type": "WEB",
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W6FM-W97V-Q5V7
Vulnerability from github – Published: 2022-05-24 16:49 – Updated: 2023-02-03 21:30IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759.
{
"affected": [],
"aliases": [
"CVE-2019-4296"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-01T15:15:00Z",
"severity": "LOW"
},
"details": "IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759.",
"id": "GHSA-w6fm-w97v-q5v7",
"modified": "2023-02-03T21:30:27Z",
"published": "2022-05-24T16:49:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4296"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/160759"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10884844"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W7F5-HW27-VF74
Vulnerability from github – Published: 2026-02-05 21:32 – Updated: 2026-02-05 21:32Tanium addressed an information disclosure vulnerability in Threat Response.
{
"affected": [],
"aliases": [
"CVE-2025-15332"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-05T19:15:54Z",
"severity": "MODERATE"
},
"details": "Tanium addressed an information disclosure vulnerability in Threat Response.",
"id": "GHSA-w7f5-hw27-vf74",
"modified": "2026-02-05T21:32:41Z",
"published": "2026-02-05T21:32:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15332"
},
{
"type": "WEB",
"url": "https://security.tanium.com/TAN-2025-020"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W7FV-7J46-WWRV
Vulnerability from github – Published: 2022-05-24 16:51 – Updated: 2023-10-26 22:47Jenkins Amazon EC2 Plugin printed a log message that contained the beginning of the private key to the Jenkins system log.
The log message no longer includes the beginning of the private key.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.43"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:ec2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.44"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10364"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-26T22:47:33Z",
"nvd_published_at": "2019-07-31T13:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Amazon EC2 Plugin printed a log message that contained the beginning of the private key to the Jenkins system log.\n\nThe log message no longer includes the beginning of the private key.",
"id": "GHSA-w7fv-7j46-wwrv",
"modified": "2023-10-26T22:47:33Z",
"published": "2022-05-24T16:51:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10364"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/ec2-plugin/commit/78c3c49a227ac8eccb8b1be7193d5605363fe251"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-07-31/#SECURITY-673"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/07/31/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Amazon EC2 Plugin leaked beginning of private key in system log"
}
GHSA-W85C-JHM2-J3FM
Vulnerability from github – Published: 2022-05-24 16:51 – Updated: 2024-04-04 01:22In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.3. The fix was back-ported to LTS 2019.6.5 as well as LTS 2019.3.7.
{
"affected": [],
"aliases": [
"CVE-2019-14268"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-25T16:15:00Z",
"severity": "MODERATE"
},
"details": "In Octopus Deploy versions 3.0.19 to 2019.7.2, when a web request proxy is configured, an authenticated user (in certain limited circumstances) could trigger a deployment that writes the web request proxy password to the deployment log in cleartext. This is fixed in 2019.7.3. The fix was back-ported to LTS 2019.6.5 as well as LTS 2019.3.7.",
"id": "GHSA-w85c-jhm2-j3fm",
"modified": "2024-04-04T01:22:12Z",
"published": "2022-05-24T16:51:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14268"
},
{
"type": "WEB",
"url": "https://github.com/OctopusDeploy/Issues/issues/5739"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W8F8-J2JJ-6QWH
Vulnerability from github – Published: 2023-10-25 21:30 – Updated: 2023-11-02 18:30A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1. An app may be able to read sensitive location information.
{
"affected": [],
"aliases": [
"CVE-2023-40405"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-25T19:15:09Z",
"severity": "LOW"
},
"details": "A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14.1. An app may be able to read sensitive location information.",
"id": "GHSA-w8f8-j2jj-6qwh",
"modified": "2023-11-02T18:30:23Z",
"published": "2023-10-25T21:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-40405"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213984"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT213984"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2023/Oct/24"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-W8HM-JRH2-57J3
Vulnerability from github – Published: 2026-08-19 15:32 – Updated: 2026-08-19 15:32Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.
{
"affected": [],
"aliases": [
"CVE-2020-37267"
],
"database_specific": {
"cwe_ids": [
"CWE-532"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-19T14:17:16Z",
"severity": "HIGH"
},
"details": "Renovate versions \u003e=19.180.0 and \u003c23.25.1, when used with Azure DevOps, may expose the bot\u0027s authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.",
"id": "GHSA-w8hm-jrh2-57j3",
"modified": "2026-08-19T15:32:25Z",
"published": "2026-08-19T15:32:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/renovatebot/renovate/security/advisories/GHSA-36rh-ggpr-j3gj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37267"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/renovate-before-token-leakage-via-logs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
Mitigation
Remove debug log files before deploying the application into production.
Mitigation
Protect log files against unauthorized read/write.
Mitigation
Adjust configurations appropriately when software is transitioned from a debug state to production.
CAPEC-215: Fuzzing for application mapping
An attacker sends random, malformed, or otherwise unexpected messages to a target application and observes the application's log or error messages returned. The attacker does not initially know how a target will respond to individual messages but by attempting a large number of message variants they may find a variant that trigger's desired behavior. In this attack, the purpose of the fuzzing is to observe the application's log and error messages, although fuzzing a target can also sometimes cause the target to enter an unstable state, causing a crash.