Lucene search

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

🗓️ 29 Nov 2024 18:13:53Reported by GitHub_MType

Server-side request forgery in Backstage Scaffolder plugin. Vulnerability in template functionality allows Server-Side Template Injection (SSTI) for Git config injection, resulting in unauthorized access to sensitive git resources. Resolved in versions v0.4.12, v0.5.1, v0.6.1 of @backstage/plugin-scaffolder-node package

Reporter	Title	Published	Views	Family All 5
OSV	Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery	2 Dec 202421:36	–	osv
CVE	CVE-2024-53983	29 Nov 202419:15	–	cve
NVD	CVE-2024-53983	29 Nov 202419:15	–	nvd
Github Security Blog	Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery	2 Dec 202421:36	–	github
Cvelist	CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin	29 Nov 202418:53	–	cvelist

Source	Link
github	www.github.com/backstage/backstage/tree/master/plugins/scaffolder-node
github	www.github.com/backstage/backstage/security/advisories/GHSA-qmc2-jpr5-7rg9

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

29 Nov 2024 18:53Current

7.3High risk

Vulners AI Score7.3

CVSS35.4

SSVC

CWE-918