PT-2018-4706 · Github · Grunt-Gh-Pages

Boennemann · Published 2018-05-31 · Updated 2019-10-09 · CVE-2016-10526

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions grunt-gh-pages versions prior to 0.10.0

Description The issue concerns the exposure of GitHub credentials in certain deployment scenarios. In setups where a GitHub token is directly injected into the URL for authentication, the token may be outputted as part of the logging function in affected versions, potentially compromising the credentials if the logs are publicly accessible.

Recommendations For versions prior to 0.10.0, update to version 0.10.0 or later.

Fix

Insertion into Log File

Weakness Enumeration

CWE-391

CWE-255

CWE-532

Related Identifiers

CVE-2016-10526

GHSA-RRJ3-QMH8-72PF

Affected Products

Grunt-Gh-Pages

References · 9

• https://osv.dev/vulnerability/CVE-2016-10526 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rrj3-qmh8-72pf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10526 · Security Note
• https://github.com/tschaub/grunt-gh-pages/pull/41/commits/590f69767203d8c379fe18cded93bd5ad6cb53cb · Note
• https://github.com/tschaub/grunt-gh-pages/pull/41 · Note
• https://github.com/tschaub/grunt-gh-pages/commit/2d277e3e969ccd4c2d493f3795400fa77e6b6342 · Note
• https://github.com/tschaub/grunt-gh-pages · Note
• https://npmjs.com/advisories/85 · Note
• https://nodesecurity.io/advisories/85 · Note