CVE-2022-3474

MEDIUM Year: 2022
CVSS v3 Score
4.3
Medium
Weakness Type
CWE-522
View all →

Vulnerability Description

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

Related Vulnerabilities

CVE-2018-1000057

MEDIUM
CVSS:4.3(Medium)

Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment ...

CWE-5222018

CVE-2019-10224

MEDIUM
CVSS:4.3(Medium)

A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager p...

CWE-5222019

CVE-2019-10421

MEDIUM
CVSS:4.3(Medium)

Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access t...

CWE-5222019

CVE-2020-17489

MEDIUM
CVSS:4.3(Medium)

An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible....

CWE-5222020

CVE-2020-2095

MEDIUM
CVSS:4.3(Medium)

Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permis...

CWE-5222020

CVE-2020-2107

MEDIUM
CVSS:4.3(Medium)

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or a...

CWE-5222020