CVE-2022-3474

🗓️ 26 Oct 2022 00:00:00Reported by GoogleType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 89 Views

Bad credential handling in remote assets API for Bazel versions prior to 5.3.2 and 4.2.

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2022-3474	26 Oct 202219:15	–	attackerkb
CBLMariner	CVE-2022-3474 affecting package bazel for versions less than 5.3.2-1	16 Nov 202202:27	–	cbl_mariner
CNNVD	Bazel 安全漏洞	26 Oct 202200:00	–	cnnvd
Cvelist	CVE-2022-3474 Bazel leaks user credentials through the remote assets API	26 Oct 202200:00	–	cvelist
EUVD	EUVD-2022-42846	3 Oct 202520:07	–	euvd
Tenable Nessus	CBL Mariner 2.0 Security Update: bazel (CVE-2022-3474)	3 Dec 202400:00	–	nessus
Tenable Nessus	Photon OS 3.0: Bazel PHSA-2023-3.0-0587	24 Jul 202400:00	–	nessus
Tenable Nessus	Photon OS 4.0: Bazel PHSA-2023-4.0-0396	23 Jul 202400:00	–	nessus
Tenable Nessus	TencentOS Server 4: bazel (TSSA-2024:1055)	16 Jun 202500:00	–	nessus
Microsoft CVE	Bazel leaks user credentials through the remote assets API	29 Oct 202207:00	–	mscve

NVD

Vulners

Vulnrichment

Node

google bazelRange3.1.0–4.2.3visual_studio

google bazelRange5.0.0–5.3.2visual_studio

[
  {
    "defaultStatus": "unaffected",
    "product": "Bazel",
    "vendor": "Google LLC",
    "versions": [
      {
        "lessThan": "5.3.2",
        "status": "affected",
        "version": "5.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "4.2.3",
        "status": "affected",
        "version": "4.0.0",
        "versionType": "semver"
      },
      {
        "lessThan": "3.7.2",
        "status": "affected",
        "version": "3.0.0",
        "versionType": "semver"
      }
    ]
  }
]