CVE-2016-10526

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.

CVSS v3 8.6 HIGH
CVSS v2.0 5.0 MEDIUM

8.6^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/tschaub/grunt-gh-pages/pull/41	Third Party Advisory
https://nodesecurity.io/advisories/85	Third Party Advisory
https://github.com/tschaub/grunt-gh-pages/pull/41	Third Party Advisory
https://nodesecurity.io/advisories/85	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:grunt-gh-pages_project:grunt-gh-pages:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2018-05-31 20:29

Updated : 2024-11-21 02:44

NVD link : CVE-2016-10526

Mitre link : CVE-2016-10526

CVE.ORG link : CVE-2016-10526

JSON object : View

Products Affected

grunt-gh-pages_project

grunt-gh-pages

CWE

CWE-391

Unchecked Error Condition

CWE-255

Credentials Management Errors

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2016-10526", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 3.9}]}, "published": "2018-05-31T20:29:00.817", "references": [{"url": "https://github.com/tschaub/grunt-gh-pages/pull/41", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "https://nodesecurity.io/advisories/85", "tags": ["Third Party Advisory"], "source": "support@hackerone.com"}, {"url": "https://github.com/tschaub/grunt-gh-pages/pull/41", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://nodesecurity.io/advisories/85", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "support@hackerone.com", "description": [{"lang": "en", "value": "CWE-391"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}, {"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised."}, {"lang": "es", "value": "Una configuraci\u00f3n habitual para desplegar en gh-pages en cada commit mediante un sistema CI es exponer un token github a ENV y emplearlo directamente en la parte auth de la URL. En module, en versiones anteriores a la 0.9.1, la porci\u00f3n auth de la URL sale como parte de la funci\u00f3n de inicio de sesi\u00f3n grunt tasks. Si esta salida est\u00e1 disponible de forma p\u00fablica, las credenciales deber\u00edan considerarse comprometidas."}], "lastModified": "2024-11-21T02:44:12.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grunt-gh-pages_project:grunt-gh-pages:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3D6707AC-A261-47DD-A0FE-59C9D3211B53", "versionEndExcluding": "0.9.1"}], "operator": "OR"}]}], "sourceIdentifier": "support@hackerone.com"}