--- title: "CX-2022-5007" date: "2022-04-28T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5007/" --- # CX-2022-5007 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) CVE-2022-0338 **Published:** Apr 28, 2022 CWE-532 CWE-532 Insertion of Sensitive Information into Log File 4.3 Medium Severity conda loguru management privilege pypi python @ @ranjit-git Reported by Checkmarx Zero Details Overview ## Summary Improper Privilege Management in Conda ‘loguru’ can allow an unprivileged user to read log files and disclose sensitive information. ## Product Conda ‘loguru’ prior to 0.6.0. ## Steps to reproduce ```from data="Data to be logged , password123 is incorrect" #sensitive data logging logger.add("combined.log") #creating log file with insecure permission logger.info(data) ``` ### Expected result: A combined.log file will be created with all log information . Check file permission: ```user@user-xx:~$ -rw-rw-r-- 1 user user 345 Jan 11 14:47 combined.log ``` This file has read permission for all system users, thus any user can read this log file. ## Remediation Change the logfile permission to be accessed only by current user who crated the file or sudo user. Or update Conda ‘loguru’ to version 0.6.0. ## Credit This issue was reported by @ranjit-git through huntr.dev. ## Resources 1. [Disclosure](https://huntr.dev/bounties/359bea50-2bc6-426a-b2f9-175d401b1ed0/) 2. [ea39375](https://github.com/delgan/loguru/commit/ea39375e62f9b8f18e2ca798a5c0fb8c972b7eaa) 0 Medium Severity CVSS v3.1 Score 4.3 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None Advisory Timeline1. Disclosed Jan 11, 2022 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)