CVE-2023-6944

Katalog CVE

CVSS 5.7 · Medium EPSS 0,56%

Kerentanan Generation of Error Message Containing Sensitive Information pada redhat red hat developer hub, linuxfoundation backstage. Skor CVSS 3.1 5.7 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.

Rincian

Terbit di NVD

4 Januari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.7 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-209: Generation of Error Message Containing Sensitive Information

EPSS (30 hari)

0,56% peluang dieksploitasi; lebih tinggi dari 45,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2023-6944 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2255204 issue tracking · advisory vendor
• https://access.redhat.com/errata/RHBA-2024:5869