github.com
https://github.com/tschaub/grunt-gh-pages CVE-2016-10526
HIGH
grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file
Record summary
CVE-2016-10526 has a selected CVSS score of 8.6 (high).
Description
A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.
Description source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
grunt-gh-pages node moduleBrowse HackerOne / grunt-gh-pages node module | CVE List | <=0.9.1 | affected |
grunt-gh-pagesBrowse npm / grunt-gh-pages | GitHub Advisory | Before 0.10.0 · Fixed in 0.10.0 | affected |
References
7github.com
https://github.com/tschaub/grunt-gh-pages/commit/2d277e3e969ccd4c2d493f3795400fa77e6b6342 github.com
https://github.com/tschaub/grunt-gh-pages/pull/41 github.com
https://github.com/tschaub/grunt-gh-pages/pull/41/commits/590f69767203d8c379fe18cded93bd5ad6cb53cb nodesecurity.io
https://nodesecurity.io/advisories/85 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2016-10526 npmjs.com
https://www.npmjs.com/advisories/85