Vulnerability · Published Oct 26, 2022 · Assigned by Google
CVE-2022-3474Bazel leaks user credentials through the remote assets API
Medium 5.1
In plain English
A medium-severity security flaw in Bazel from Google LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Severity (CVSS 4.0)5.1Medium
Exploit odds (30 days)0.4%top 65.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google LLC | Bazel | 5.0.0 – before 5.3.24.0.0 – before 4.2.33.0.0 – before 3.7.2 |
Weakness: CWE-522 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N