PT-2024-24089 · Stacklok · Minder

Eleftherias · Published 2024-04-09 · Updated 2024-06-04 · CVE-2024-31455

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Minder by Stacklok versions prior to the version that includes pull request 2941

Description A recent refactoring added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue allows for a data leak.

Recommendations For versions prior to the patch in pull request 2941, revert prior to commit 5c381cf, or roll forward past 2eb94e7 to resolve the issue. As a temporary workaround, consider restricting access to the affected SQL query until a patch is available.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-31455

GHSA-GGP5-28X4-XCJ9

GO-2024-2701

Affected Products

Minder

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31455.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-31455 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31455 · Security Note
• https://osv.dev/vulnerability/GHSA-ggp5-28x4-xcj9 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2701 · Vendor Advisory
• https://github.com/stacklok/minder/commit/11b6573ad62cfdd783a8bb52f3fce461466037f4 · Note
• https://github.com/stacklok/minder/pull/2941 · Note
• https://github.com/stacklok/minder · Note
• https://github.com/stacklok/minder/security/advisories/GHSA-ggp5-28x4-xcj9 · Note
• https://github.com/stacklok/minder/commit/5c381cfbf3e4b7ce040ed8511a1fae1a78a0014b · Note
• https://twitter.com/CVEnew/status/1779016084492042498 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1777768427362418931 · Twitter Post