What is the CVSS score of CVE-2022-24875?

CVE-2022-24875 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.9%.

Is there a patch available for CVE-2022-24875?

Yes, a patch is available for CVE-2022-24875. Update the affected software to the latest version immediately.

Cve Services CVE-2022-24875

HIGH

Insertion of Sensitive Information into Log File (CWE-532)

2022-04-21 security-advisories@github.com

Information Disclosure Cve Services

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Apr 21, 2022 - 18:15 nvd

HIGH 7.5

DescriptionNVD

The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the org.conroller.js code would erroneously log user secrets. This has been resolved in commit 46d98f2b and should be available in subsequent versions of the software. Users of the software are advised to manually apply the 46d98f2b commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate.

AnalysisAI

The CVEProject/cve-services is an open source project used to operate the CVE services api. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-532. The CVEProject/cve-services is an open source project used to operate the CVE services api. In versions up to and including 1.1.1 the org.conroller.js code would erroneously log user secrets. This has been resolved in commit 46d98f2b and should be available in subsequent versions of the software. Users of the software are advised to manually apply the 46d98f2b commit or to update when a new version becomes available. As a workaround users should inspect their logs and remove logged secrets as appropriate. Affected products include: Cve Cve-Services.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.