CVE-2024-23686: Owasp Dependency-Check

Medium severity, CVSS 5.3. EPSS: 0.6% chance of exploitation in the next 30 days.

DependencyCheck for Maven 9.0.0 to 9.0.6, for CLI version 9.0.0 to 9.0.5, and for Ant versions 9.0.0 to 9.0.5, when used in debug mode, allows an attacker to recover the NVD API Key from a log file.

Affected products

• Owasp Dependency-Check: from 9.0.0, up to and including 9.0.5; from 9.0.0, before 9.0.6 (fixed in 9.0.6)

Published 2024-01-19. Last modified 2026-07-14.