{"affected":[{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.owasp:dependency-check-maven","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThanOrEqual":"9.0.6","status":"affected","version":"9.0.0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.owasp:dependency-check-cli","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThanOrEqual":"9.0.5","status":"affected","version":"9.0.0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"maven","packageName":"org.owasp:dependency-check-ant","product":"","source":"CNA: VulnCheck","vendor":"","versions":[{"lessThanOrEqual":"9.0.5","status":"affected","version":"9.0.0","versionType":"maven"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"org.owasp:dependency-check-ant","product":"org.owasp:dependency-check-ant","source":"OSV GHSA-qqhq-8r2c-c3f5","vendor":"","versions":[{"status":"affected","version":"9.0.0","versionType":"Maven"},{"status":"affected","version":"9.0.1","versionType":"Maven"},{"status":"affected","version":"9.0.2","versionType":"Maven"},{"status":"affected","version":"9.0.3","versionType":"Maven"},{"status":"affected","version":"9.0.4","versionType":"Maven"},{"status":"affected","version":"9.0.5","versionType":"Maven"},{"events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}],"status":"unknown","version":"9.0.0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"org.owasp:dependency-check-cli","product":"org.owasp:dependency-check-cli","source":"OSV GHSA-qqhq-8r2c-c3f5","vendor":"","versions":[{"status":"affected","version":"9.0.0","versionType":"Maven"},{"status":"affected","version":"9.0.1","versionType":"Maven"},{"status":"affected","version":"9.0.2","versionType":"Maven"},{"status":"affected","version":"9.0.3","versionType":"Maven"},{"status":"affected","version":"9.0.4","versionType":"Maven"},{"status":"affected","version":"9.0.5","versionType":"Maven"},{"events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}],"status":"unknown","version":"9.0.0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"Maven","packageName":"org.owasp:dependency-check-maven","product":"org.owasp:dependency-check-maven","source":"OSV GHSA-qqhq-8r2c-c3f5","vendor":"","versions":[{"status":"affected","version":"9.0.0","versionType":"Maven"},{"status":"affected","version":"9.0.1","versionType":"Maven"},{"status":"affected","version":"9.0.2","versionType":"Maven"},{"status":"affected","version":"9.0.3","versionType":"Maven"},{"status":"affected","version":"9.0.4","versionType":"Maven"},{"status":"affected","version":"9.0.5","versionType":"Maven"},{"events":[{"introduced":"9.0.0"},{"fixed":"9.0.6"}],"status":"unknown","version":"9.0.0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2024-23686","cwes":["CWE-532"],"description":"DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.","epss":{"date":"2026-11-08","percentile":0.49121,"score":0.00603},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.1"}],"modifiedAt":1794146402156,"publishedAt":1705698733288,"references":[{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5"},{"source":"CNA: VulnCheck","tags":["vendor-advisory"],"url":"https://github.com/advisories/GHSA-qqhq-8r2c-c3f5"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5"},{"source":"ADP: CVE","tags":["vendor-advisory","x_transferred"],"url":"https://github.com/jeremylong/DependencyCheck/security/advisories/GHSA-qqhq-8r2c-c3f5"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://github.com/advisories/GHSA-qqhq-8r2c-c3f5"},{"source":"ADP: CVE","tags":["third-party-advisory","x_transferred"],"url":"https://vulncheck.com/advisories/vc-advisory-GHSA-qqhq-8r2c-c3f5"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-qqhq-8r2c-c3f5"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-qqhq-8r2c-c3f5"}],"remediation":[{"kind":"fix","source":"OSV GHSA-qqhq-8r2c-c3f5","text":"org.owasp:dependency-check-ant (Maven): OSV reports a fixed version 9.0.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-qqhq-8r2c-c3f5"},{"kind":"fix","source":"OSV GHSA-qqhq-8r2c-c3f5","text":"org.owasp:dependency-check-cli (Maven): OSV reports a fixed version 9.0.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-qqhq-8r2c-c3f5"},{"kind":"fix","source":"OSV GHSA-qqhq-8r2c-c3f5","text":"org.owasp:dependency-check-maven (Maven): OSV reports a fixed version 9.0.6. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-qqhq-8r2c-c3f5"}],"revision":"76b2fe30deef0f6f5a81a633ee39a58267848d34e919e038eb8d7be5cae84dd9","sources":[{"modifiedAt":1794146402156,"name":"CNA: VulnCheck","retrievedAt":1794146936962,"url":"https://www.cve.org/CVERecord?id=CVE-2024-23686"},{"modifiedAt":1783493397802,"name":"OSV / GitHub Security Advisories","retrievedAt":1794146937398,"url":"https://osv.dev/vulnerability/GHSA-qqhq-8r2c-c3f5"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150558150,"url":"https://api.first.org/data/v1/epss?cve=CVE-2024-23686"}],"ssvc":{"assessedAt":1708460377408,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"DependencyCheck Debug Mode Logging of NVD API Key","updatedAt":1794150558150}