CVE-2022-39304CWE-209

ghinstallation returns app JWT in error responses

Medium · published December 20, 2022

CVSS v3.1
5.0
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1, when the request to refresh an installation token failed, the HTTP request and response would be returned for debugging. The request contained the bearer JWT for the App, and was returned back to clients. This token is short lived (10 minute maximum). This issue has been patched and is available in version 2.0.0.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2022-12-20T19:52Z
EPSS history
Timeline
  • 20 DEC 19:52Z
    ghinstallation returns app JWT in error responses
    cvelistv5