1. Home
  2. CVE Database
  3. CVE-2016-10526
HIGH · 8.6

CVE-2016-10526

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion ...

Vulnerability Description

A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion of the url is outputted as part of the grunt tasks logging function. If this output is publicly available then the credentials should be considered compromised.

CVSS Score

8.6

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
Grunt-Gh-Pages ProjectGrunt-Gh-Pages< 0.9.1

Related Weaknesses (CWE)

CWE-532CWE-255CWE-391

References

FAQ

What is CVE-2016-10526?

CVE-2016-10526 is a vulnerability with a CVSS score of 8.6 (HIGH). A common setup to deploy to gh-pages on every commit via a CI system is to expose a github token to ENV and to use it directly in the auth part of the url. In module versions < 0.9.1 the auth portion ...

How severe is CVE-2016-10526?

CVE-2016-10526 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2016-10526?

Check the references section above for vendor advisories and patch information. Affected products include: Grunt-Gh-Pages Project Grunt-Gh-Pages.