Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder task logs. An authenticated user who can create and read scaffolder tasks may be able to observe sensitive values in task logs in deployments with restrictive action permissions and affected templates.
Exploitation requires a denied action whose input contains such a value. This issue is fixed in version 4.1.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Linuxfoundation Backstage\/Plugin-Scaffolder-Backend
cpe:2.3:a:linuxfoundation:backstage\/plugin-scaffolder-backend:*:*:*:*:*:*:*:*
|
— |
4.1.0
|
|
Linuxfoundation Backstage
cpe:2.3:a:linuxfoundation:backstage:*:*:*:*:*:*:*:*
|
— |
1.54.6
|
References 3
https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444
https://github.com/backstage/backstage/security/advisories/GHSA-4xvq-3m68-h444
https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb4…
https://github.com/backstage/backstage/commit/3eb3dc59eb0da0deccd532f19eb460bb452c9efb
https://github.com/backstage/backstage/releases/tag/v1.54.6
https://github.com/backstage/backstage/releases/tag/v1.54.6