CVE-2023-44483

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Oct 20, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-444846.1Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the CVE-2023-444877.5The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as CVE-2023-444887.5VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.CVE-2023-44498.8A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been classified as critical. Affect CVE-2023-44509.8A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknow CVE-2023-44516.1Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.CVE-2023-44527.5A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerab CVE-2023-44535.4Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.CVE-2023-44545.7Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.CVE-2023-44556.5Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.CVE-2023-44566.5A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user wi CVE-2023-44577.5Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.