CVE-2022-39397

2022-11-2221:15:10

CWE-200

[email protected]

web.nvd.nist.gov

aliyun

alibaba

oss

rust

client

security

disclosure

patch

5.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

19.6%

JSON

aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This issue has been patched in version 0.8.1.

Affected configurations

Vulners

NVD

Node

tu6geoss_rsRange<0.8.1

CPENameOperatorVersion
aliyun-oss-client_project:aliyun-oss-clientaliyun-oss-client project aliyun-oss-clientlt0.8.1

CPE	Name	Operator	Version
aliyun-oss-client_project:aliyun-oss-client	aliyun-oss-client project aliyun-oss-client	lt	0.8.1

CNA Affected

[
  {
    "vendor": "tu6ge",
    "product": "oss-rs",
    "versions": [
      {
        "version": "< 0.8.1",
        "status": "affected"
      }
    ]
  }
]