CVE-2022-39351

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, performing an API request using a valid API key with insufficient permissions causes the API key to be written to Dependency-Track's audit log in clear text. Actors with access to the audit log can exploit this flaw to gain access to valid API keys. The issue has been fixed in Dependency-Track 4.6.0. Instead of logging the entire API key, only the last 4 characters of the key will be logged. It is strongly recommended to check historic logs for occurrences of this behavior, and re-generating API keys in case of leakage.

• CWE-312
• CWE-312

• https://docs.dependencytrack.org/changelog/Product, Release Notes
• https://github.com/DependencyTrack/dependency-track/blob/4.5.0/src/main/docker/logback.xmlThird Party Advisory
• https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-gh7v-4hxp-gqp4Third Party Advisory
• https://docs.dependencytrack.org/changelog/Product, Release Notes
• https://github.com/DependencyTrack/dependency-track/blob/4.5.0/src/main/docker/logback.xmlThird Party Advisory
• https://github.com/DependencyTrack/dependency-track/security/advisories/GHSA-gh7v-4hxp-gqp4Third Party Advisory

Published

Oct 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39346Nextcloud server is an open source personal cloud server. Af…6.5
• CVE-2022-39347FreeRDP is a free remote desktop protocol library and client…5.7
• CVE-2022-39348Twisted is an event-based framework for internet application…5.4
• CVE-2022-39349The Tasks.org Android app is an open-source app for to-do li…5.5
• CVE-2022-3935The Welcart e-Commerce WordPress plugin before 2.8.4 does no…5.4
• CVE-2022-39350@dependencytrack/frontend is a Single Page Application (SPA)…5.4
• CVE-2022-39352OpenFGA is a high-performance authorization/permission engin…9.8
• CVE-2022-39353xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…9.8
• CVE-2022-39354SputnikVM, also called evm, is a Rust implementation of Ethe…7.5
• CVE-2022-39355Discourse Patreon enables syncronization between Discourse G…9.8
• CVE-2022-39356Discourse is a platform for community discussion. Users who …8.8
• CVE-2022-39357Winter is a free, open-source content management system base…9.8