CVE-2024-23686

MediumCVSS 5.3

Published: 19/01/2024(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

45th percentile - higher than 45% of all known CVEs

Summary

DependencyCheck for Maven 9.0.0-9.0.6, CLI 9.0.0-9.0.5, and Ant 9.0.0-9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

Risk Assessment

The risk involves exposure of the confidential NVD API key, potentially leading to unauthorized access to data or attacks on systems relying on this key.

Recommendation

It is recommended to immediately update DependencyCheck to version 9.0.7 or later and avoid using debug mode in production environments.

Original NVD description (English source)

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.