CVE-2020-5262CWE-532

GitHub personal access token leaking into temporary EasyBuild (debug) logs

High · published March 19, 2020

CVSS v3.1
7.7
EPSS
1%
Percentile
45.0
In the wild
Unconfirmed
What it is

In EasyBuild before version 4.1.2, the GitHub Personal Access Token (PAT) used by EasyBuild for the GitHub integration features (like `--new-pr`, `--fro,-pr`, etc.) is shown in plain text in EasyBuild debug log files. This issue is fixed in EasyBuild v4.1.2, and in the `master`+ `develop` branches of the `easybuild-framework` repository.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00545 · 45.0th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2020-03-19T17:05Z
EPSS history
Timeline
  • 19 MAR 17:05Z
    GitHub personal access token leaking into temporary EasyBuild (debug) logs
    cvelistv5