CVE-2024-9621

MEDIUM

Quarkus CXF - Sensitive Information Disclosure in Log Files

Title source: llm

Description

A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging properties, and the attacker must have access to the application log.

References (3)

Core 3

Core References

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:10035

Vendor Advisory vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2024-9621

Issue Tracking issue-tracking x_refsource_redhat

https://bugzilla.redhat.com/show_bug.cgi?id=2317130

Scores

CVSS v3 5.3

EPSS 0.0051

EPSS Percentile 39.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-532

Status published

Products (2)

io.quarkiverse.cxf/quarkus-cxf 0 - 3.15.2Maven

Red Hat/Red Hat Build of Apache Camel 4.4 for Quarkus 3.8

Published Oct 08, 2024

Tracked Since Feb 18, 2026