CVE-2022-39326

2022-10-2517:15:56

CWE-94

[email protected]

web.nvd.nist.gov

cve-2022-39326

kartverket

github-workflows

code injection

vulnerability

github actions

nvd

security advisory

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

61.1%

JSON

kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the run-terraform reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a malicious payload leading to execution of arbitrary JavaScript code in the context of the workflow. Users should upgrade to at least version 2.7.5 to resolve the issue. As a workaround, review any pull requests from external users for malicious payloads before allowing them to trigger a build.

Affected configurations

Vulners

NVD

Node

kartverketgithub-workflowsRange<2.7.5

VendorProductVersionCPE
kartverketgithub\-workflows*cpe:2.3:a:kartverket:github\-workflows:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
kartverket	github\-workflows	*	cpe:2.3:a:kartverket:github\-workflows::::::::

CNA Affected

[
  {
    "vendor": "kartverket",
    "product": "github-workflows",
    "versions": [
      {
        "version": "< 2.7.5",
        "status": "affected"
      }
    ]
  }
]