Lucene search

K
cvelistGitHub_MCVELIST:CVE-2024-31455
HistoryApr 09, 2024 - 4:52 p.m.

CVE-2024-31455 Minder GetRepositoryByName data leak

2024-04-0916:52:03
CWE-200
GitHub_M
raw.githubusercontent.com
1
minder
getrepositorybyname
data leak
cve-2024-31455

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.6%

Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit 5c381cf added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue is patched in pull request 2941. As a workaround, revert prior to 5c381cf, or roll forward past 2eb94e7.

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.6%

Related for CVELIST:CVE-2024-31455