Lucene search

GoogleOSV:GO-2022-0812

HistoryAug 21, 2024 - 3:29 p.m.

Reject unauthorized access with GitHub PATs in github.com/go-vela/server

2024-08-2115:29:02

Google

osv.dev

github

unauthorized access

pats

server

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

AI Score

6.7

Confidence

High

JSON

Reject unauthorized access with GitHub PATs in github.com/go-vela/server

References

github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46

github.com/go-vela/server/pull/337

github.com/go-vela/server/releases/tag/v0.7.5

github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4

nvd.nist.gov/vuln/detail/CVE-2021-21432

pkg.go.dev/github.com/go-vela/server

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L

AI Score

6.7

Confidence

High

JSON

Related for OSV:GO-2022-0812