CVE-2022-39351

    Dashboard / Vulnerabilities / CVE-2022-39351

    CVE-2022-39351

    Published: 25 Oct 2022Last Modified: 28 Oct 2026

    Summary: Dependency-Track vulnerable to logging of API keys in clear text when handling API requests using keys with insufficient permissions

    Details: Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit log in clear text. Actors with access to the audit log can exploit this flaw to gain access to valid API keys. The issue has been fixed in Dependency-Track 4.6.0. Instead of logging the entire API key, only the last 4 characters of the key will be logged. It is strongly recommended to check historic logs for occurrences of this behavior, and re-generating API keys in case of leakage.

    References: https://docs.dependencytrack.org/changelog/, https://github.com/DependencyTrack/dependency-track/blob/4.5.0/src/main/docker/logback.xml, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39351.json, https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-gh7v-4hxp-gqp4, https://nvd.nist.gov/vuln/detail/CVE-2022-39351

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -18e9a134462100cb37c12d602fc913362bd79a6e

    Affected versions

    4.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-39351 | CVE-DB