CVE-2021-21361: falha de média gravidade em JLLeitschuh security-research
Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 1.2%
The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0.
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Produtos afetados
JLLeitschuh · security-researchReferências
https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44https://github.com/bmuschko/gradle-vagrant-plugin/issues/19https://github.com/bmuschko/gradle-vagrant-plugin/pull/20https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7