CVE-2021-21361 Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin
The Gradle Vagrant plugin logs system environment variables, potentially exposing sensitive credentials in public CI/CD logs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-21361?
CVE-2021-21361 is a medium-severity vulnerability in JLLeitschuh security-research, published on 9 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0.
Weakness: CWE-532
Which versions are affected by CVE-2021-21361?
2 open source packages ship an affected version, including com.bmuschko:gradle-vagrant-plugin. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.bmuschko:gradle-vagrant-plugin Maven | From 0.6 | 3.0.0 |
com.bmuschko:gradle-vagrant-plugin Maven | From 0.6 | 3.0.0 |
Products include Vagrant Project Vagrant.
How do I fix CVE-2021-21361?
Upgrade com.bmuschko:gradle-vagrant-plugin to 3.0.0 or later.
Is CVE-2021-21361 being exploited?
There is no known exploitation of CVE-2021-21361 in the wild and no public exploit code.
Sources
Also known as GHSA-jpcm-4485-69p7.