CVE-2021-41151

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...

@backstage/plugin-scaffolder-backend-module-cookiecutter (0.1.0), @backstage/plugin-scaffolder-backend-module-rails (>=0.1.1, <=0.1.3) potentially affected by CVE-2021-41151 via @backstage/plugin-scaffolder-backend (>=0.12.4, <=0.14.2)

@backstage/plugin-scaffolder-backend NPM version =0.12.4, =0.1.1, =0.1.3 Source cves: CVE-2021-41151 Source advisory: MEND:CVE-2021-41151...

CVE-2021-41151

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...

PT-2021-23131

Name of the Vulnerable Software and Affected Versions @backstage/plugin-scaffolder-backend versions prior to 0.15.9 Description A malicious actor could read sensitive files from the environment where Scaffolder tasks are run by crafting a custom Scaffolder template with a...

CVE-2021-41151: Improper Limitation of a Pathname to a Restricted Directory

Backstage is an open platform for building developer portals. In affected versions A malicious actor could read sensitive files from the environment where Scaffolder Tasks are run. The attack is executed by crafting a custom Scaffolder template with a github:publish:pull-request action and a...

@backstage/plugin-api-docs (>=0.1.1-alpha.18, <=0.1.1), @backstage/plugin-catalog (>=0.0.0-nightly-202010102951, <=0.2.9) +20 more potentially affected by CVE-2021-32661 via @backstage/plugin-techdocs (>=0.0.0-nightly-20220708025041, <=0.5.8)

@backstage/plugin-techdocs NPM version =0.0.0-nightly-20220708025041, =0.1.1-alpha.18, =0.0.0-nightly-202010102951, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.17, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.9, =0.1.1-alpha.22, =0.1.1-alpha.13, =0.1.1-alpha.19, =0.0.0-nightly-20220504024625...

CVE-2021-32661

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin "@backstage/plugin-techdocs" prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an "object" element...

@backstage/plugin-api-docs (>=0.1.1-alpha.18, <=0.1.1), @backstage/plugin-catalog (>=0.0.0-nightly-202010102951, <=0.2.9) +20 more potentially affected by CVE-2021-32661 via @backstage/plugin-techdocs (>=0.0.0-nightly-20220708025041, <=0.5.8)

@backstage/plugin-techdocs NPM version =0.0.0-nightly-20220708025041, =0.1.1-alpha.18, =0.0.0-nightly-202010102951, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.17, =0.1.1-alpha.22, =0.1.1-alpha.25, =0.1.1-alpha.9, =0.1.1-alpha.22, =0.1.1-alpha.13, =0.1.1-alpha.19, =0.0.0-nightly-20220504024625...

PT-2021-19839

Name of the Vulnerable Software and Affected Versions @backstage/plugin-techdocs versions prior to 0.9.5 Description A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This may give access to sensitive...

CVE-2021-32661: Improper Neutralization of Special Elements used in a Command

Backstage is an open platform for building developer portals. In versions of Backstage's Techdocs Plugin @backstage/plugin-techdocs prior to 0.9.5, a malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an object element. This...