Lucene search
Veracode Vulnerability DatabaseVERACODE:27506HistoryOct 02, 2020 - 4:37 a.m.
Environment Variables Tampering
2020-10-0204:37:22
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
11
0.001 Low
EPSS
Percentile
40.3%
@actions/core allows tampering of environment variables. The addPath and exportVariable functions that communicate with the Actions Runner over stdout allows the unauthorized modification of the path or environment variables.
| CPE | Name | Operator | Version |
|---|---|---|---|
| @actions/core | le | 1.2.5 | |
| @actions/core | le | 1.2.5 |
Related
gitlab
gitlab
Improper Input Validation
2020-10-01 00:00:00
osv
osv
Environment Variable Injection in GitHub Actions
2020-10-01 17:16:20
nvd
nvd
CVE-2020-15228
2020-10-01 18:15:12
github
github
Environment Variable Injection in GitHub Actions
2020-10-01 17:16:20
githubexploit
githubexploit
Exploit for Command Injection in Toolkit Project Toolkit
2020-11-12 11:59:47
prion
prion
Design/Logic Flaw
2020-10-01 18:15:00
cvelist
cvelist
CVE-2020-15228 Environment Variable Injection in GitHub Actions
2020-10-01 17:25:12
cve
cve
CVE-2020-15228
2020-10-01 18:15:12
