CVE-2025-55285

Katalog CVE

CVSS 2.6 · Low EPSS 0,24%

Kerentanan Insertion of Sensitive Information into Log File. Skor CVSS 3.1 2.6 (Low) menurut github.com.

Deskripsi (NVD)

@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. Prior to version 2.1.1, duplicate logging of the input values in the fetch:template action in the Scaffolder meant that some of the secrets were not properly redacted. If ${{ secrets.x }} is not passed through to fetch:template there is no impact. This issue has been resolved in 2.1.1 of the scaffolder-backend plugin. A workaround for this issue involves Template Authors removing the use of ${{ secrets }} being used as an argument to fetch:template.

Rincian

Terbit di NVD

15 Agustus 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

2.6 (Low), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-532: Insertion of Sensitive Information into Log File

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/backstage/backstage/commit/c371f6fe12371de31dca537510e6653e287cdc2e
• https://github.com/backstage/backstage/security/advisories/GHSA-3x3q-ghcp-whf7