GitHub Advisoryadvisory · npm

GHSA-ghgq-x6wc-6jr5 Zowe CLI allows storage of previously entered secure credentials in a plaintext file

MEDIUM Published 2024-07-17 Modified 2024-07-17 Official page ↗
Aliases
CVE-2024-6833
Ecosystem
npm
Packages
@zowe/cli
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-256
Reviewed
2024-07-17

Affected packages

• npm @zowe/cli: >= 7.18.0, < 7.23.5 → fixed in 7.23.5

Description

A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation.

Related

Alias · CVE (1)

  • CVE-2024-6833 A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of… vulnerability

Weakness · CWE (1)

  • CWE-256 Plaintext Storage of a Password weakness

References