CVE-2020-26294CWE-78

Exposure of server configuration

High · published January 4, 2021

CVSS v3.1
7.4
EPSS
2%
Percentile
78.3
In the wild
Unconfirmed
What it is

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. In Vela compiler before version 0.6.1 there is a vulnerability which allows exposure of server configuration. It impacts all users of Vela. An attacker can use Sprig's `env` function to retrieve configuration information, see referenced GHSA for an example. This has been fixed in version 0.6.1. In addition to upgrading, it is recommended to rotate all secrets.

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01798 · 78.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-01-04T18:35Z
EPSS history
Timeline
  • 04 JAN 18:35Z
    Exposure of server configuration
    cvelistv5