CVE-2020-37267highCWE-532

CVE-2020-37267: falha de alta gravidade em renovatebot renovate

Renovate 19.180.0 before 23.25.1 Token Leakage via Logs

Publicada em

Seguir esta CVE+ Monitorar renovate+ Monitorar renovate

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.7epss 0.4%
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
renovatebot · renovate
CVEs relacionadas — renovatebot renovate

No mesmo produto, das mais perigosas para as menos.

CVE-2026-88889HIGHRenovate before 44.14.7 Command Injection via distributionTypeEPSS 1.0%CVE-2026-76231HIGHRenovate 32.135.0 before 40.33.0 Command Injection via hermitEPSS 1.0%CVE-2026-76232HIGHRenovate 31.51.0 before 40.33.0 Command Injection via helmv3EPSS 1.0%CVE-2026-76230HIGHRenovate 35.63.0 before 40.33.0 Command Injection via npmEPSS 1.0%CVE-2026-76233HIGHRenovate 39.53.0 before 40.33.0 Command Injection via gleam managerEPSS 1.0%CVE-2026-76229HIGHRenovate 39.218.0 before 40.33.0 Arbitrary Command Injection via kustomizeEPSS 1.0%