PT-2018-4706 · Github · Grunt-Gh-Pages

Boennemann · Publicado 2018-05-31 · Atualizado 2019-10-09 · CVE-2016-10526

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions grunt-gh-pages versions prior to 0.10.0

Description The issue concerns the exposure of GitHub credentials in certain deployment scenarios. In setups where a GitHub token is directly injected into the URL for authentication, the token may be outputted as part of the logging function in affected versions, potentially compromising the credentials if the logs are publicly accessible.

Recommendations For versions prior to 0.10.0, update to version 0.10.0 or later.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-391

CWE-255

CWE-532

Identificadores relacionados

CVE-2016-10526

GHSA-RRJ3-QMH8-72PF

Produtos afetados

Grunt-Gh-Pages

Referências · 9

• https://github.com/tschaub/grunt-gh-pages/pull/41/commits/590f69767203d8c379fe18cded93bd5ad6cb53cb · Nota
• https://github.com/tschaub/grunt-gh-pages/pull/41 · Nota
• https://github.com/tschaub/grunt-gh-pages/commit/2d277e3e969ccd4c2d493f3795400fa77e6b6342 · Nota
• https://github.com/tschaub/grunt-gh-pages · Nota
• https://osv.dev/vulnerability/CVE-2016-10526 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rrj3-qmh8-72pf · Aviso do Fabricante
• https://npmjs.com/advisories/85 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-10526 · Nota de Segurança
• https://nodesecurity.io/advisories/85 · Nota