Backstage 安全漏洞

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. A security vulnerability exists in versions prior to Backstage 1.10.13 that stems from the possibility of accessing the contents of an entire storage bucket when using AWS S3 or GCS...

Backstage 安全漏洞

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. Backstage 1.10.13 security vulnerability , the vulnerability stems from the TechDocs storage bucket content controlled by an attacker , able to inject in the TechDocs content can be...

Backstage 安全漏洞

Backstage is a Backstage open source application. Backstage is an open platform for building developer portals. A security vulnerability exists in Backstage version 1.25.0, which originates from an instance of Backstage with the Directory Backend plugin installed, where a malicious actor with...

PT-2024-9768 · Google +2 · Gcs +2

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-techdocs-backend versions prior to 1.10.13 Description: The issue is related to the Backstage platform, an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs, it is...

PT-2024-9764 · Npm · @Backstage/Plugin-Catalog-Backend

Name of the Vulnerable Software and Affected Versions: @backstage/plugin-catalog-backend versions prior to 1.26.0 Description: A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed can interrupt the service using a specially crafted query to...

Important: Red Hat Bug Fix Advisory: Red Hat Developer Hub 1.2.3 bugfix release

Red Hat Developer Hub 1.2.3 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single...

Malicious code in @live-backstage/client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59a85f5255ffeaed2480c5affaf5967984d6b21631800dee033bd1c44c762ce5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8014 Malicious code in @live-backstage/client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59a85f5255ffeaed2480c5affaf5967984d6b21631800dee033bd1c44c762ce5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-26150

A flaw was found in the backstage/backend-common package. Path checks with the "resolveSafeChildPath" utility were not exhaustive enough, leading to the risk of a path traversal vulnerability if symlinks are injected by attackers. Mitigation Mitigation for this issue is either not available or th...

Important: Red Hat Enhancement Advisory: Red Hat Developer Hub 1.1 release

Red Hat Developer Hub 1.1 has been released. Red Hat Developer Hub RHDH is Red Hat's enterprise-grade, self-managed, customizable developer portal based on Backstage.io. RHDH is supported on OpenShift and other major Kubernetes clusters AKS, EKS, GKE. The core features of RHDH include a single pa...

GHSA-2FC9-XPP8-2G9H `@backstage/backend-common` vulnerable to path traversal through symlinks

Impact Paths checks with the resolveSafeChildPath utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. Patches Patched in @backstage/backend-common version 0.21.1. Patched in @backstage/backend-common version 0.20.2. Patch...

@adamlonsdale/backstage-plugin-armorcode-backend (>=0.0.1-alpha <=0.0.4), @austin-garrard/backstage-plugin-backend (>=0.0.1 <=0.0.1-alpha.22) +188 more potentially affected by CVE-2024-26150 via @backstage/backend-common (>=0.0.0-nightly-20220708025041 <=0.17.0)

@backstage/backend-common NPM version =0.0.0-nightly-20220708025041, =0.0.1-alpha, =0.0.1, =0.0.1, =0.1.0, =0.0.0-nightly-20220709024234, =0.0.0-nightly-20220811024336, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20220709024234, =0.0.0-nightly-2022042277, =0.0.0-nightly-20216821837,...

CVE-2024-26150

@backstage/backend-common is a common functionality library for backends for Backstage, an open platform for building developer portals. In @backstage/backend-common prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the resolveSafeChildPath utility were not exhaustive enough, leadi...

Path traversal

@backstage/backend-common is a common functionality library for backends for Backstage, an open platform for building developer portals. In @backstage/backend-common prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the resolveSafeChildPath utility were not exhaustive enough, leadi...

CVE-2024-26150

CVE-2024-26150 affects @backstage/backend-common prior to versions 0.21.1, 0.20.2, and 0.19.10, where path checks in resolveSafeChildPath were not exhaustive, enabling potential path traversal if symlinks are injected. The issue is publicly documented across multiple sources (NVD, GHSA advisory, ...

CVE-2024-26150 `@backstage/backend-common` vulnerable to path traversal through symlinks

@backstage/backend-common is a common functionality library for backends for Backstage, an open platform for building developer portals. In @backstage/backend-common prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the resolveSafeChildPath utility were not exhaustive enough, leadi...

CVE-2024-26150 `@backstage/backend-common` vulnerable to path traversal through symlinks

@backstage/backend-common is a common functionality library for backends for Backstage, an open platform for building developer portals. In @backstage/backend-common prior to versions 0.21.1, 0.20.2, and 0.19.10, paths checks with the resolveSafeChildPath utility were not exhaustive enough, leadi...

Backstage Security Vulnerabilities

Backstage is a software application. Backstage is an open platform for building developer portals. A security vulnerability exists in Backstage backend-common, which stems from insufficiently detailed path checking using "resolveSafeChildPath". The vulnerability can be exploited to access files a...

PT-2024-21301 · Npm · @Backstage/Backend-Common

Name of the Vulnerable Software and Affected Versions: @backstage/backend-common versions prior to 0.21.1 @backstage/backend-common versions prior to 0.20.2 @backstage/backend-common versions prior to 0.19.10 Description: The issue concerns the @backstage/backend-common library, where paths check...

Backstage Information Disclosure Vulnerability

Backstage is a software application. Backstage is an open platform for building developer portals. A security vulnerability exists in Backstage that stems from the GitlabDiscoveryEntityProvider leaking gitlab integration tokens in logs when tokens with newlines are supplied...