Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-31455

Good to know:

icon

Date: April 9, 2024

Minder by Stacklok is an open source software supply chain security platform. A refactoring in commit "5c381cf" added the ability to get GitHub repositories registered to a project without specifying a specific provider. Unfortunately, the SQL query for doing so was missing parenthesis, and would select a random repository. This issue is patched in pull request 2941. As a workaround, revert prior to "5c381cf", or roll forward past "2eb94e7".

Language: Go

Severity Score

Related Resources (7)

https://github.com/stacklok/minder/pull/2941
https://github.com/stacklok/minder/commit/11b6573ad62cfdd783a8bb52f3fce461466037f4
https://github.com/stacklok/minder/commit/5c381cfbf3e4b7ce040ed8511a1fae1a78a0014b
https://github.com/stacklok/minder/security/advisories/GHSA-ggp5-28x4-xcj9
https://nvd.nist.gov/vuln/detail/CVE-2024-31455
https://github.com/stacklok/minder
https://www.mend.io/vulnerability-database/CVE-2024-31455

Severity Score

Weakness Type (CWE)

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

Top Fix

icon

Upgrade Version

Upgrade to version github.com/stacklok/minder - v0.0.40

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): LOW
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us