CVE-2022-3474 MEDIUM

CVE-2022-3474: Bazel leaks user credentials through the remote assets API

Vendor Google Llc
Product Bazel
Weakness CWE-522 · Insufficiently protected credentials
Published October 26, 2022
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Adjacent
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

What the vulnerability does

01Description

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

Key dates

02Disclosure timeline

October 26, 2022 CVE published
August 3, 2024 Record updated