CVE-2024-52009highCWE-532

CVE-2024-52009: falha de alta gravidade em runatlantis atlantis

Git credentials are exposed in atlantis logs

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar atlantis+ Monitorar github.com/runatlantis/atlantis

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.5epss 0.7%
Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. Atlantis logs contains GitHub credentials (tokens `ghs_...`) when they are rotated. This enables an attacker able to read these logs to impersonate Atlantis application and to perform actions on GitHub. When Atlantis is used to administer a GitHub organization, this enables getting administration privileges on the organization. This was reported in #4060 and fixed in #4667 . The fix was included in Atlantis v0.30.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Produtos afetados
runatlantis · atlantis
CVEs relacionadas — runatlantis atlantis

No mesmo produto, das mais perigosas para as menos.

CVE-2026-64679HIGHAtlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory Deletion/CreationEPSS 0.8%CVE-2026-116676HIGHAtlantis: OS command injection through PR-controlled Terraform workspace enables RCE during planEPSS 0.5%CVE-2025-58445MEDIUMAtlantis Exposes Service Version Publicly on /status API EndpointEPSS 0.5%CVE-2026-82282HIGHAtlantis GitHub App Setup Endpoint Returns App Credentials to Unauthenticated CallersEPSS 0.4%