PkgSeer

Vulnerability GHSA-7hfw-grcm-cqm6

Medium Risk

1 hour ago

Backstage: Incorrect authorization in scaffolder task listing

0.0.0-nightly-202010102951 - 4.1.0-next.0

Summary

Backstage: Incorrect authorization in scaffolder task listing

Details

Impact

An authenticated internal user may be able to view metadata for scaffolder tasks outside the visibility intended by a deployment's permission policy. Stored task secrets are not included in the affected response, and no integrity or availability impact was identified.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

Restrict the scaffolder task-list endpoint at the ingress or authenticating proxy to users who are permitted to view all tasks.
Avoid placing sensitive values in template input parameters until the patched package is deployed.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Backstage may expose sensitive information in Scaffolder task failure events

0.0.0-nightly-202010102951 - 4.1.0-next.0 GHSA-95p4-vv4g-jxxm

Backstage has sensitive information exposure in scaffolder task logs

0.0.0-nightly-202010102951 - 4.1.0-next.0 GHSA-4xvq-3m68-h444

Backstage has improper input validation in scaffolder task list ordering

0.0.0-nightly-202010102951 - 4.1.0-next.0 GHSA-vwp5-f99x-x3rq

@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

3.1.0 - 3.1.4 GHSA-8wq8-6859-qx77

@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass

0.0.0-nightly-202010102951 - 3.1.4-next.0 GHSA-8qp7-fhr9-fw53

View all vulnerabilities for these packages

Impacted packages

@backstage/plugin-scaffolder-backend

Timeline

Published

1 hour ago

Fixed (4.1.0)

1 month ago

Last Modified

1 hour ago