{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-14T10:08:11.089","vulnerabilities":[{"cve":{"id":"CVE-2024-32028","sourceIdentifier":"security-advisories@github.com","published":"2024-04-12T23:15:06.643","lastModified":"2026-04-15T00:35:42.020","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of `OpenTelemetry.Instrumentation.Http` and `OpenTelemetry.Instrumentation.AspNetCore` the `url.full` writes attribute/tag on spans (`Activity`) when tracing is enabled for outgoing http requests and `OpenTelemetry.Instrumentation.AspNetCore` writes the `url.query` attribute/tag on spans (`Activity`) when tracing is enabled for incoming http requests. These attributes are defined by the Semantic Conventions for HTTP Spans. Up until version `1.8.1` the values written by `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will pass-through the raw query string as was sent or received (respectively). This may lead to sensitive information (e.g. EUII - End User Identifiable Information, credentials, etc.) being leaked into telemetry backends (depending on the application(s) being instrumented) which could cause privacy and/or security incidents. Note: Older versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` may use different tag names but have the same vulnerability. The `1.8.1` versions of `OpenTelemetry.Instrumentation.Http` & `OpenTelemetry.Instrumentation.AspNetCore` will now redact by default all values detected on transmitted or received query strings. Users are advised to upgrade. There are no known workarounds for this vulnerability."},{"lang":"es","value":"OpenTelemetry dotnet es un framework de telemetría dotnet. En las versiones afectadas de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore`, `url.full` escribe atributos/etiquetas en intervalos (`Activity`) cuando el rastreo está habilitado para solicitudes http salientes y `OpenTelemetry.Instrumentation. AspNetCore` escribe el atributo/etiqueta `url.query` en intervalos (`Actividad`) cuando el seguimiento está habilitado para solicitudes http entrantes. Estos atributos están definidos por las convenciones semánticas para intervalos HTTP. Hasta la versión `1.8.1`, los valores escritos por `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pasarán a través de la cadena de consulta sin formato tal como se envió o recibió (respectivamente). Esto puede dar lugar a que se filtre información confidencial (por ejemplo, EUII: información identificable del usuario final, credenciales, etc.) a los servidores de telemetría (dependiendo de las aplicaciones que se instrumenten), lo que podría causar incidentes de privacidad y/o seguridad. Nota: Las versiones anteriores de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` pueden usar nombres de etiquetas diferentes pero tienen la misma vulnerabilidad. Las versiones `1.8.1` de `OpenTelemetry.Instrumentation.Http` y `OpenTelemetry.Instrumentation.AspNetCore` ahora redactarán de forma predeterminada todos los valores detectados en las cadenas de consulta transmitidas o recibidas. Se recomienda a los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","baseScore":4.1,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":1.4}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-201"},{"lang":"en","value":"CWE-212"}]}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42","source":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f","source":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md","source":"security-advisories@github.com"},{"url":"https://github.com/open-telemetry/opentelemetry-dotnet/commit/e222ecb5942d4ce1cadfd4306c39e3f4933a5c42","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/open-telemetry/opentelemetry-dotnet/security/advisories/GHSA-vh2m-22xx-q94f","source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/open-telemetry/semantic-conventions/blob/main/docs/http/http-spans.md","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}