CWE-538
AllowedInsertion of Sensitive Information into Externally-Accessible File or Directory
Abstraction: Base · Status: Draft
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
172 vulnerabilities reference this CWE, most recent first.
GHSA-XGGC-QPRG-X6MW
Vulnerability from github – Published: 2022-06-23 17:40 – Updated: 2022-06-23 17:40Impact
A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters, including the service account tokens in plain text from Weave GitOps's pod logs on the management cluster. An unauthorized remote attacker can also view these sensitive configurations from external log storage if enabled by the management cluster.
This vulnerability is due to the client factory dumping cluster configurations and their service account tokens when the cluster manager tries to connect to an API server of a registered cluster, and a connection error occurs. An attacker could exploit this vulnerability by either accessing logs of a pod of Weave GitOps, or from external log storage and obtaining all cluster configurations of registered clusters.
A successful exploit could allow the attacker to use those cluster configurations to manage the registered Kubernetes clusters.
Patches
This vulnerability has been fixed by commit 567356f471353fb5c676c77f5abc2a04631d50ca. Users should upgrade to Weave GitOps core version >= v0.8.1-rc.6 released on 31/05/2022.
Workarounds
There is no workaround for this vulnerability.
References
Disclosed by Stefan Prodan, Principal Engineer, Weaveworks.
For more information
If you have any questions or comments about this advisory: * Open an issue in Weave GitOps repository * Email us at support@weave.works
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.1-rc.5"
},
"package": {
"ecosystem": "Go",
"name": "github.com/weaveworks/weave-gitops"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.1-rc.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31098"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-209",
"CWE-532",
"CWE-538"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-23T17:40:34Z",
"nvd_published_at": "2022-06-27T22:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\nA vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters, including the service account tokens in plain text from Weave GitOps\u0027s pod logs on the management cluster. An unauthorized remote attacker can also view these sensitive configurations from external log storage if enabled by the management cluster.\n\nThis vulnerability is due to the client factory dumping cluster configurations and their service account tokens when the cluster manager tries to connect to an API server of a registered cluster, and a connection error occurs. An attacker could exploit this vulnerability by either accessing logs of a pod of Weave GitOps, or from external log storage and obtaining all cluster configurations of registered clusters.\n\nA successful exploit could allow the attacker to use those cluster configurations to manage the registered Kubernetes clusters.\n\n### Patches\nThis vulnerability has been fixed by commit 567356f471353fb5c676c77f5abc2a04631d50ca. Users should upgrade to Weave GitOps core version \u003e= v0.8.1-rc.6 released on 31/05/2022.\n\n### Workarounds\nThere is no workaround for this vulnerability.\n\n### References\nDisclosed by Stefan Prodan, Principal Engineer, Weaveworks.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Weave GitOps repository](https://github.com/weaveworks/weave-gitops)\n* Email us at [support@weave.works](mailto:support@weave.works)\n",
"id": "GHSA-xggc-qprg-x6mw",
"modified": "2022-06-23T17:40:34Z",
"published": "2022-06-23T17:40:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-xggc-qprg-x6mw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31098"
},
{
"type": "WEB",
"url": "https://github.com/weaveworks/weave-gitops/commit/567356f471353fb5c676c77f5abc2a04631d50ca"
},
{
"type": "PACKAGE",
"url": "https://github.com/weaveworks/weave-gitops"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Weave GitOps leaked cluster credentials into logs on connection errors"
}
GHSA-XM94-9JW8-P6HW
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2022-06-28 23:09Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.1.18"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:credentials"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.19"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-10320"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-538"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-28T23:09:37Z",
"nvd_published_at": "2019-05-21T13:29:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.",
"id": "GHSA-xm94-9jw8-p6hw",
"modified": "2022-06-28T23:09:37Z",
"published": "2022-05-24T16:46:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10320"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/credentials-plugin/commit/40d0b5cc53c265b601ffaa4469310fad390a80fb"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2019:1605"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:1636"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2019-05-21/#SECURITY-1322"
},
{
"type": "WEB",
"url": "https://wwws.nightwatchcybersecurity.com/2019/05/23/exploring-the-file-system-via-jenkins-credentials-plugin-vulnerability-cve-2019-10320"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/May/39"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/05/21/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/108462"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin"
}
Mitigation
Do not expose file and directory information to the user.
CAPEC-95: WSDL Scanning
This attack targets the WSDL interface made available by a web service. The attacker may scan the WSDL interface to reveal sensitive information about invocation patterns, underlying technology implementations and associated vulnerabilities. This type of probing is carried out to perform more serious attacks (e.g. parameter tampering, malicious content injection, command injection, etc.). WSDL files provide detailed information about the services ports and bindings available to consumers. For instance, the attacker can submit special characters or malicious content to the Web service and can cause a denial of service condition or illegal access to database records. In addition, the attacker may try to guess other private methods by using the information provided in the WSDL files.