CVE-2024-35232: falha de baixa gravidade em huandu facebook
github.com/huandu/facebook may expose access_token in error message
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.5%
github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. access_token can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
huandu · facebookReferências
https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/http/client.go;l=629-633https://cs.opensource.google/go/go/+/refs/tags/go1.22.3:src/net/url/url.go;l=30https://github.com/huandu/facebook/blob/1591be276561bbdb019c0279f1d33cb18a650e1b/session.go#L558-L567https://github.com/huandu/facebook/commit/8b34431b91b32903c8821b1d7621bf81a029d8e4https://github.com/huandu/facebook/security/advisories/GHSA-3f65-m234-9mxr