Vulnerability · Published Jul 21, 2022 · Assigned by GitHub_M

CVE-2022-31162Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs

High 7.5

In plain English

A high-severity information exposure in slack-morphism-rust from abdolence. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.9%top 39.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive information in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurations in logs.

Affected products (as reported)

Vendor	Product	Versions
abdolence	slack-morphism-rust	< 0.41.0

Weakness: CWE-1258, CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84p x_refsource_CONFIRM
https://github.com/abdolence/slack-morphism-rust/releases/tag/v0.41.0 x_refsource_MISC