Skip to main content

Insufficiently Protected Credentials

CVE-2024-28110

High
7.5/10

Summary

Go SDK for CloudEvents is the official CloudEvents SDK to integrate applications with CloudEvents using cloudevents withRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper causes the go-sdk to leak credentials to arbitrary endpoints. When the transport is populated with an authenticated transport, then "http.DefaultClient" is modified with the authenticated transport and will start to send Authorization tokens to any endpoint it is used to contact. This issue affects prior to version 2.15.2.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-522 - Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References

Advisory Timeline

  • Published