CVE-2023-50253

Katalog CVE

CVSS 6.5 · Medium EPSS 0,74%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada laf. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allows authenticated users to obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in the logs. As of time of publication, no known patched versions exist.

Rincian

Terbit di NVD

3 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD. Ditampilkan 60 dari 139 konfigurasi; daftar lengkap ada di NVD.

Referensi dan perbaikan

• https://github.com/labring/laf/pull/1468 advisory pihak ketiga
• https://github.com/labring/laf/security/advisories/GHSA-g9c8-wh35-g75f exploit · advisory pihak ketiga