CVE-2022-3474 Bazel leaks user credentials through the remote assets API
Bazel leaks all user-provided credentials instead of only required ones via the remote assets API, exposing sensitive authentication data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-3474?
CVE-2022-3474 is a medium-severity vulnerability in Google LLC Bazel, published on 26 Oct 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.
Weakness: CWE-522
Which versions are affected by CVE-2022-3474?
It affects 1 product.
Products include Google Bazel.
How do I fix CVE-2022-3474?
Upgrade to a fixed version.
Is CVE-2022-3474 being exploited?
There is no known exploitation of CVE-2022-3474 in the wild and no public exploit code.
Other vulnerabilities in Google LLC Bazel
Sources
Also known as AZL-11350, GHSA-mxr8-q875-rhwq.