CVE-2023-6944

A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2023-6944	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2255204	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:red_hat_developer_hub:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*

History

10 Jan 2024, 17:04

Type	Values Removed	Values Added
CWE		CWE-209
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.7
First Time		Redhat Redhat red Hat Developer Hub Linuxfoundation Linuxfoundation backstage
CPE		cpe:2.3:a:linuxfoundation:backstage:::::::: cpe:2.3:a:redhat:red_hat_developer_hub::::::::
References	~~() https://access.redhat.com/security/cve/CVE-2023-6944 -~~	() https://access.redhat.com/security/cve/CVE-2023-6944 - Vendor Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=2255204 -~~	() https://bugzilla.redhat.com/show_bug.cgi?id=2255204 - Issue Tracking, Vendor Advisory

04 Jan 2024, 10:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-01-04 10:15

Updated : 2024-02-28 20:54

NVD link : CVE-2023-6944

Mitre link : CVE-2023-6944

CVE.ORG link : CVE-2023-6944

JSON object : View

Products Affected

redhat

red_hat_developer_hub

linuxfoundation

backstage

CWE

CWE-209

Generation of Error Message Containing Sensitive Information

{"id": "CVE-2023-6944", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "published": "2024-01-04T10:15:11.517", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-6944", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2255204", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-209"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-209"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en Red Hat Developer Hub (RHDH). La funci\u00f3n catalog-import filtra tokens de acceso de GitLab en la interfaz cuando el token de GitLab codificado en base64 incluye una nueva l\u00ednea al final de la cadena. El error sanitizado puede aparecer en la interfaz, incluido el token de acceso sin formato. Al obtener acceso a este token y dependiendo de los permisos, un atacante podr\u00eda enviar c\u00f3digo malicioso a repositorios, eliminar recursos en Git, revocar o generar nuevas claves y firmar c\u00f3digo de forma ileg\u00edtima."}], "lastModified": "2024-02-04T20:15:46.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:red_hat_developer_hub:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03D5A3A5-63FC-42D4-BF87-4B2B466EDB3F", "versionEndExcluding": "1.21.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9DD9C33C-E29A-4DFF-9C5A-CA2A87D0B6C1", "versionEndExcluding": "1.21.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}