Information Disclosure

2021-05-1004:30:08

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

hashicorp

vault

information disclosure

multi-line secrets

credentials

EPSS

0.002

Percentile

55.4%

JSON

github.com/hashicorp/vault-action/ is vulnerable to information disclosure. Multi-line secrets are not properly masked in its output and can potentially result in credentials disclosure.

References

discuss.hashicorp.com/t/hcsec-2021-13-vault-github-action-did-not-correctly-mask-multi-line-secrets-in-output/24128

github.com/hashicorp/vault-action/blob/master/CHANGELOG.md

github.com/hashicorp/vault-action/issues/205

github.com/hashicorp/vault-action/pull/208

EPSS

0.002

Percentile

55.4%

JSON

Related for VERACODE:30402