CVE-2022-3474CWE-522

Bazel leaks user credentials through the remote assets API

Medium · published October 26, 2022

CVSS v4.0
5.1
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00335 · 25.7th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2022-10-26T00:00Z
EPSS history
Timeline
  • 26 OCT 00:00Z
    Bazel leaks user credentials through the remote assets API
    cvelistv5