Description

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.

Remediation

References

https://snyk.io/vuln/SNYK-JS-SNYKBROKER-570613

https://updates.snyk.io/snyk-broker-security-fixes-152338

Related Vulnerabilities

CVE-2022-28220 Vulnerability in maven package org.apache.james:james-server-protocols-managesieve

CVE-2023-50722 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui

CVE-2023-46120 Vulnerability in maven package com.rabbitmq:amqp-client

CVE-2023-34465 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authorization-bridge

CVE-2018-11698 Vulnerability in npm package node-sass

Severity

High

Classification

CWE-532 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Patch Vendor Advisory