Vulnerability GHSA-95p4-vv4g-jxxm

Medium Risk

2 hours ago

Backstage may expose sensitive information in Scaffolder task failure events

0.0.0-nightly-202010102951 - 4.1.0-next.0

Summary

Backstage may expose sensitive information in Scaffolder task failure events

Details

Impact

Under specific template and failure conditions, an authenticated user may be able to retrieve sensitive values from Scaffolder task events. This can expose backend-managed credentials used during task execution.

Patches

Patched in @backstage/plugin-scaffolder-backend version 4.1.0

Workarounds

Restrict Scaffolder template execution and task-event access to trusted users until the patched version is deployed.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Medium Risk

1 hour ago

Backstage: Incorrect authorization in scaffolder task listing

0.0.0-nightly-202010102951 - 4.1.0-next.0 GHSA-7hfw-grcm-cqm6

Medium Risk

2 hours ago

Backstage has sensitive information exposure in scaffolder task logs

0.0.0-nightly-202010102951 - 4.1.0-next.0 GHSA-4xvq-3m68-h444

Medium Risk

2 hours ago

Backstage has improper input validation in scaffolder task list ordering

0.0.0-nightly-202010102951 - 4.1.0-next.0 GHSA-vwp5-f99x-x3rq

Medium Risk

6 months ago

@backstage/plugin-scaffolder-backend: Possible exposure of defaultEnvironment secrets using dry-run endpoint

3.1.0 - 3.1.4 GHSA-8wq8-6859-qx77

Low Risk

7 months ago

@backstage/plugin-scaffolder-backend Vulnerable to Potential Session Token Exfiltration via Log Redaction Bypass

0.0.0-nightly-202010102951 - 3.1.4-next.0 GHSA-8qp7-fhr9-fw53

View all vulnerabilities for these packages

Impacted packages

@backstage/plugin-scaffolder-backend

Timeline

Published

2 hours ago

Fixed (4.1.0)

1 month ago

Last Modified

2 hours ago