CVE-2021-21432

Reject unauthorized access with GitHub PATs

Severity Score

6.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Refer to the referenced GitHub Security Advisory for complete details. This is fixed in version 0.7.5.

Vela es un framework de Pipeline Automation (CI/CD) construido sobre la tecnología de contenedores de Linux escrita en Golang. Un mecanismo de autenticación agregado en versión 0.7.0, permite a algunos usuarios maliciosos obtener secretos usando las credenciales inyectadas dentro del archivo "~/.netrc". Consulte el Aviso de Seguridad de GitHub al que se hace referencia para obtener detalles completos. Esto es corregido en versión 0.7.5

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Attack Vector

Network

Attack Complexity

Medium

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2020-12-22 CVE Reserved
2021-04-09 CVE Published
2023-03-08 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-285: Improper Authorization
CWE-862: Missing Authorization

CAPEC

References (5)

URL	Tag	Source
https://github.com/go-vela/server/releases/tag/v0.7.5	Release Notes
https://github.com/go-vela/server/security/advisories/GHSA-8j3f-mhq8-gmh4	Third Party Advisory
https://pkg.go.dev/github.com/go-vela/server	Release Notes

URL	Date	SRC

URL	Date	SRC
https://github.com/go-vela/server/commit/cb4352918b8ecace9fe969b90404d337b0744d46	2022-08-12
https://github.com/go-vela/server/pull/337	2022-08-12

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Go-vela Search vendor "Go-vela"		Vela Search vendor "Go-vela" for product "Vela"				< 0.7.5 Search vendor "Go-vela" for product "Vela" and version " < 0.7.5"		-		Affected