Insertion of Sensitive Information into Log File Affecting steeltoe.discovery.clientcore package, versions [,3.0.0)
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (11th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DOTNET-STEELTOEDISCOVERYCLIENTCORE-7538446
- published 18 Jul 2024
- disclosed 17 Jul 2024
- credit Unknown
Introduced: 17 Jul 2024
CVE-2024-40636 Open this link in a new tabHow to fix?
Upgrade Steeltoe.Discovery.ClientCore to version 3.0.0 or higher.
Overview
Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry. An attacker can gain access to credentials by examining the error logs which include unmasked URLs containing basic authentication details.