@backstage/backend-common (>=0.0.0-nightly-20230111022819, <=0.0.0-nightly-20240612021718), @backstage/backend-defaults (>=0.0.0-nightly-20220811024336, <=0.0.0-nightly-20260818023149) +26 more potentially affected by CVE-2023-6944 via @backstage/backend-app-api (>=0.0.0-nightly-20220811024336, <=0.0.0-nightly-20260818023149)

@backstage/backend-app-api NPM version =0.0.0-nightly-20220811024336, =0.0.0-nightly-20230111022819, =0.0.0-nightly-20220811024336, =0.0.0-nightly-20240214021031, =0.0.0-nightly-20220813024304, =0.0.0-nightly-20220813024304, =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240929023448,...

CVE-2023-6944

CVE-2023-6944 affects Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 GitLab token ends with a newline, causing the sanitized error to reveal the raw token. With access to the token and appropriate permissions, an attacker could...

CVE-2023-6944 Rhdh: catalog-import function leaks credentials to frontend

A flaw was found in the Red Hat Developer Hub RHDH. The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gainin...

CVE-2023-6944 Rhdh: catalog-import function leaks credentials to frontend

A flaw was found in the Red Hat Developer Hub RHDH. The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gainin...