CVE-2023-44312 Apache ServiceComb Service-Center: attacker can query all environment variables of the service-center server

2024-01-3108:49:12

CWE-200

apache

www.cve.org

cve-2023-44312

apache servicecomb service-center

sensitive information

unauthorized actor

upgrade

version 2.2.0

5.8 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

24.4%

JSON

Exposure of Sensitive Information to an Unauthorized Actor in Apache ServiceComb Service-Center.This issue affects

Apache ServiceComb Service-Center

before 2.1.0 (include).

Users are recommended to upgrade to version 2.2.0, which fixes the issue.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache ServiceComb Service-Center",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.1.0",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]