# CVE-2023-34339: In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the excep...

> CVE-2023-34339 (GitHub advisory GHSA-w2c4-vpgj-g3jp) is a low-severity vulnerability with a CVSS 3.1 base score of 3.3, classed as Generation of Error Message Containing Sensitive Information (CWE-209), in github.com/ktorio/ktor (Git repository). Affected versions: < 2.3.1. It is fixed in 2.3.1.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2023-34339

| Field | Value |
| --- | --- |
| CVE | CVE-2023-34339 |
| GHSA | GHSA-w2c4-vpgj-g3jp |
| Severity | Low |
| CVSS 3.1 | 3.3 `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N` (GitHub Advisory Database) |
| CWE | CWE-209 Generation of Error Message Containing Sensitive Information |
| EPSS | 0.21% (higher than 9% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact partial |
| Published | 1 Jun 2023 |
| Modified | 8 Jan 2025 |

## Description

In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| https://github.com/ktorio/ktor | GIT | `pkg:github/ktorio/ktor` | < 2.3.1 | 2.3.1 |

## Questions

**What is the GHSA ID for CVE-2023-34339?**

GitHub tracks CVE-2023-34339 as GHSA-w2c4-vpgj-g3jp.

**What is the CVSS score of CVE-2023-34339?**

CVE-2023-34339 has a CVSS 3.1 base score of 3.3 (Low), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.

**Which versions are affected by CVE-2023-34339?**

https://github.com/ktorio/ktor (GIT): < 2.3.1.

**How do I fix CVE-2023-34339?**

Upgrade to 2.3.1 or later.

**What is the Package URL (PURL) for CVE-2023-34339?**

The affected package's PURL is pkg:github/ktorio/ktor.

**Is CVE-2023-34339 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2023-34339. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none". EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 9% of CVEs.

## References

- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34339.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2023-34339 (advisory)
- https://github.com/advisories/GHSA-w2c4-vpgj-g3jp (advisory)
- https://www.jetbrains.com/privacy-security/issues-fixed/

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2023-34339), compiled from GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.