The vulnerability identified as CVE-2024-9621 affects Quarkus CXF and involves the insertion of sensitive information, including passwords and secrets, into application log files. This occurs even when users configure these secrets to be hidden. The issue requires specific configurations to be vulnerable, including SOAP logging enabled, application set client, and endpoint logging properties. Exploitation requires the attacker to have access to the application logs. Red Hat has published advisories acknowledging the issue but currently does not offer a patch or mitigation that meets their standards for ease of use, applicability, or stability.

Sensitive information such as passwords and secrets may be exposed in application logs, potentially allowing an attacker with access to these logs to obtain confidential data. The vulnerability does not affect integrity or availability but has a high confidentiality impact. Exploitation requires network access, low privileges, and no user interaction, but with high attack complexity due to the required configuration and log access.

Red Hat currently states that no mitigation or patch meeting their criteria for ease of use, applicability, or stability is available. Users should be aware of the conditions that enable this vulnerability, such as enabling SOAP logging and specific client and endpoint logging configurations, and restrict access to application logs to trusted parties. Monitoring and controlling log access is critical until a fix is released. Users should follow Red Hat advisories for updates and apply patches once available.