CVE-2023-39348 is a medium-severity information disclosure vulnerability affecting Linux Foundation Spinnaker, specifically when using GitHub Status Notifications. The flaw causes GitHub tokens to be improperly logged in full, potentially exposing them. This could grant unauthorized read access to repositories or elevated access if the token has broader permissions. The vulnerability has a CVSS score of 5.3 (Medium), indicating a network-based attack with low complexity, requiring no user interaction, and resulting in low confidentiality impact. While the EPSS score is low, suggesting a low probability of exploitation, the FAUCET Risk Score is 19/100, indicating a moderate risk. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this vulnerability. Users are advised to upgrade Spinnaker, disable GitHub Status Notifications, filter logs, or use limited-scope read-only tokens as mitigation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.28.8CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* | ||
>= 1.29.0, < 1.29.6CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* | ||
>= 1.30.0, < 1.30.3CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:spinnaker:*:*:*:*:*:*:*:* | ||
1.30.0CPE matchmatch criteria | cpe:2.3:a:linuxfoundation:spinnaker:1.30.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.