SB2024070361 - Inclusion of Sensitive Information in Log Files in grpc-go

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024070361

SB2024070361 - Inclusion of Sensitive Information in Log Files in grpc-go

Published: July 3, 2024 Updated: August 19, 2026

Security Bulletin ID SB2024070361
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inclusion of Sensitive Information in Log Files (CVE-ID: N/A)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in grpc metadata logging when logging context containing gRPC metadata. A local user can read log output to disclose sensitive information.

Private tokens may be exposed if application logging includes context values that contain gRPC metadata.


Remediation

Install update from vendor's website.

References