CVE-2020-11059 Exposure of Sensitive Information to an Unauthorized Actor in AEgir
AEgir build tool leaks environment variable secrets into published browser bundles, exposing sensitive data to unauthorized actors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-11059?
CVE-2020-11059 is a critical vulnerability in IPFS AEgir, published on 27 May 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In AEgir greater than or equal to 21.7.0 and less than 21.10.1, aegir publish and aegir build may leak secrets from environment variables in the browser bundle published to npm. This has been fixed in 21.10.1.
Weakness: CWE-200
Which versions are affected by CVE-2020-11059?
2 open source packages ship an affected version, including aegir. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
aegir npm | From 21.7.0 | 21.10.1 |
aegir npm | From 21.7.0 | 21.10.1 |
Products include Aegir Project Aegir.
How do I fix CVE-2020-11059?
Upgrade aegir to 21.10.1 or later.
Is CVE-2020-11059 being exploited?
There is no known exploitation of CVE-2020-11059 in the wild and no public exploit code.
Other vulnerabilities in IPFS AEgir
Sources
Also known as GHSA-qfcv-5whw-7pcw.