CVE Vulnerability

CVE-2022-39326

kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `run-terraform` reusable workflow from the kartverket/github-workflows repo are affected by a code injection vulnerability. A malicious actor could potentially send a PR with a malicious payload leading to execution of arbitrary JavaScript code in the context of the workflow. Users should upgrade to at least version 2.7.5 to resolve the issue. As a workaround, review any pull requests from external users for malicious payloads before allowing them to trigger a build.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/kartverket/github-workflows/security/advisories/GHSA-f9qj-7gh3-mhj4 Third Party Advisory
https://github.com/kartverket/github-workflows/pull/19 Patch Third Party Advisory
https://github.com/kartverket/github-workflows/releases/tag/v2.7.5 Patch Release Notes
Configurations

Configuration 1

cpe:2.3:a:kartverket:github-workflows:*:*:*:*:*:*:*:*
Information

Published : 2022-10-25 05:15

Updated : 2022-10-28 07:26

NVD link : CVE-2022-39326

Mitre link : CVE-2022-39326

Products Affected
No products.
CWE
CWE-94