CVE-2023-39348

mediumPriorität · verfolgen · 21EPSS 0.004 · 32. PerzentilEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.38% (32nd) EPSS

CVSS 5.3 · medium

Is it mine?

12 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-27

Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log system, the risk is slightly higher than a "low" since token exposure could grant elevated access to repositories outside of control. If using READ restricted tokens, the exposure is such that the token itself could be used to access resources otherwise restricted from reads. This only affects users of GitHub Status Notifications. This issue has been addressed in pull request 1316. Users are advised to upgrade. Users unable to upgrade should disable GH Status Notifications, Filter their logs for Echo log data and use read-only tokens that are limited in scope.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.3

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 1.4

v3.14mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · ENISA EU

v3.14mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · security-advisories@github.comAusnutzbarkeit 0.9 · Auswirkung 2.7

v3.14mediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:Nsecondary · OSV

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-532USCWE-532US

betroffene Produkte (12)

Betroffene Produkte und Versionsbereiche.

spinnaker spinnaker≤ < 1.28.8enisa_euvdEU
spinnaker spinnaker1.29.0, → 1.29.6enisa_euvdEU
spinnaker spinnaker1.30.0, → 1.30.3enisa_euvdEU
spinnaker spinnaker1.31.0, → 1.31.1enisa_euvdEU
linuxfoundation spinnaker< 1.28.8nvdUScpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*
linuxfoundation spinnaker1.29.0 → 1.29.6nvdUScpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*
linuxfoundation spinnaker= 1.30.0nvdUScpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*
linuxfoundation spinnaker1.30.0 → 1.30.3nvdUScpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:*
Go github.com/spinnaker/spinnakeralle VersionenosvUSpkg:golang/github.com/spinnaker/spinnaker
Go github.com/spinnaker/spinnaker≥ 1.29.0osvUSpkg:golang/github.com/spinnaker/spinnaker
Go github.com/spinnaker/spinnaker≥ 1.30.0osvUSpkg:golang/github.com/spinnaker/spinnaker
Go github.com/spinnaker/spinnaker≥ 1.31.0osvUSpkg:golang/github.com/spinnaker/spinnaker

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-rq5c-hvw6-8pr7Improper log output when using GitHub Status Notifications in spinnaker2023-08-29ghsa · osvUS
### Impact ONLY IMPACTS those use GitHub Status Notifications Log output when updating GitHub status is improperly set to FULL always. It's recommended to apply the patch and rotate the GitHub token used for github status notifications. Given that this would output github tokens to a log system, the risk is slightly higher than a "low" since token exposure could grant elevated access to repositories outside of control. If using READ restricted tokens, the exposure is such that the token itself could be used to access resources otherwise restricted from reads. ### Patches Patch is in progress. https://github.com/spinnaker/echo/pull/1316 ### Workarounds Disable GH Status Notifications. Filter your logs for Echo log data. Use read-only tokens that are limited in scope. ### References sig-security in slack: https://spinnakerteam.slack.com/archives/CFN8F5UR2

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

veröffentlicht 2023-08-28geändert 2026-06-17

Referenzen (7)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan