Veracode Vulnerability DatabaseVERACODE:47094

HistoryMay 21, 2024 - 1:04 p.m.

GitHub Token Leakage

2024-05-2113:04:43

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

token leakage

wolfictl

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

10.3%

JSON

github.com/wolfi-dev/wolfictl is vulnerable to GitHub Token Leakage. The vulnerability is due to a local user’s GitHub token being sent to remote servers other than github.com if a user ran wolfictl update with a non github domain.

References

github.com/advisories/GHSA-8fg7-hp93-qhvr

github.com/wolfi-dev/wolfictl/blob/488b53823350caa706de3f01ec0eded9350c7da7/pkg/update/update.go#L143

github.com/wolfi-dev/wolfictl/blob/4dd6c95abb4bc0f9306350a8601057bd7a92bded/pkg/update/deps/cleanup.go#L49

github.com/wolfi-dev/wolfictl/blob/6d99909f7b1aa23f732d84dad054b02a61f530e6/pkg/git/git.go#L22

github.com/wolfi-dev/wolfictl/commit/0d06e1578300327c212dda26a5ab31d09352b9d0

github.com/wolfi-dev/wolfictl/commit/403e93569f46766b4e26e06cf9cd0cae5ee0c2a2

github.com/wolfi-dev/wolfictl/security/advisories/GHSA-8fg7-hp93-qhvr

CVSS3

4.4

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

10.3%

JSON

Related for VERACODE:47094