CVE-2024-9621 json
Io.quarkiverse.cxf:quarkus-cxf: quarkus cxf may log user password and secret to application log
published 2024-10-08 2 y ago modified 2026-08-08 3 mo ago also GHSA-jqh2-ch7p-xwxh , EUVD-2024-3074
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
A vulnerability was found in Quarkus CXF. Passwords and other secrets may appear in the application log in spite of the user configuring them to be hidden. This issue requires some special configuration to be vulnerable, such as SOAP logging enabled, application set client, and endpoint logging properties, and the attacker must have access to the application log.
Patch / fix
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-9621 updated cvss 5.3
io.quarkiverse.cxf:quarkus-cxf: Quarkus CXF may log user password and secret to application log
-
Red Hat Build of Apache Camel 4.4 for Quarkus 3.8fixed: vendor fix RHSA-2024:10035
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.52% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | io.quarkiverse.cxf:quarkus-cxf | <3.15.2 |
3.15.2 |
Affected products
- Red Hat Red Hat Build of Apache Camel 4.4 for Quarkus 3.8
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
github.com
/quarkiverse/quarkus-cxf/commit/8ed72cab8db8e5659e294b05529d2b45557859bd
web
-
access.redhat.com
/errata/RHSA-2024:10035
vendor-advisory, web
-
access.redhat.com
/security/cve/CVE-2024-9621
vdb-entry, web
-
bugzilla.redhat.com
/show_bug.cgi?id=2317130
issue-tracking, web
-
nvd.nist.gov
/vuln/detail/CVE-2024-9621
advisory
-
github.com
/quarkiverse/quarkus-cxf/issues/1533
web
-
docs.quarkiverse.io
/quarkus-cxf/dev/release-notes/3.15.2.html
web
-
github.com
/quarkiverse/quarkus-cxf
package
Sources
- CVE List CVE-2024-9621
- GitHub Advisory GHSA-jqh2-ch7p-xwxh
- NVD CVE-2024-9621
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.