From 2e4f177e1c4f0d0741c94fa7c9d9721fe1c88a96 Mon Sep 17 00:00:00 2001 From: CVE Team Date: Fri, 9 Aug 2024 20:00:35 +0000 Subject: [PATCH] "-Synchronized-Data." --- 2024/42xxx/CVE-2024-42370.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/2024/42xxx/CVE-2024-42370.json b/2024/42xxx/CVE-2024-42370.json index 451f51acd3f..9dabd2a8a21 100644 --- a/2024/42xxx/CVE-2024-42370.json +++ b/2024/42xxx/CVE-2024-42370.json @@ -11,7 +11,7 @@ "description_data": [ { "lang": "eng", - "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue will grant a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue." + "value": "Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions 2.10.0 and prior, Litestar's `docs-preview.yml` workflow is vulnerable to Environment Variable injection which may lead to secret exfiltration and repository manipulation. This issue grants a malicious actor the permission to write issues, read metadata, and write pull requests. In addition, the `DOCS_PREVIEW_DEPLOY_TOKEN` is exposed to the attacker. Commit 84d351e96aaa2a1338006d6e7221eded161f517b contains a fix for this issue." } ] },