Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events.
This issue is fixed in version 4.1.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Linuxfoundation Backstage\/Plugin-Scaffolder-Backend
cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*
|
— |
4.1.0
|
|
Linuxfoundation Backstage
cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
|
— |
1.54.6
|
References 3
https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm
https://github.com/backstage/backstage/security/advisories/GHSA-95p4-vv4g-jxxm
https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb25…
https://github.com/backstage/backstage/commit/3f1e869708f002fb9838624b7379deb251691b47
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/backstage/backstage/releases/tag/v1.54.6