by Kastro
Paper/Archive/CVE-2020-11059

CVE-2020-11059

IPFS AEgir — Exposure of Sensitive Information to an Unauthorized Actor in AEgir

EPSS 1%CVSS 9.6
critical.is priorityof 100
42
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 66.2.662 × 2013.2No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.

Affected

ProductAffectedFixed inSource
AEgir>= 21.7.0, < 21.10.1–CNA

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References

refgithub.com/ipfs/aegir/security/advisories/GHSA-qfcv-5whw-7pcw