CVE-2023-2138 Use of Hard-coded Credentials in nuxtlabs/github-module
Hard-coded credentials in the Nuxt GitHub module allow attackers to bypass security controls and access sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-2138?
CVE-2023-2138 is a critical vulnerability in nuxtlabs/github-module, published on 18 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use of Hard-coded Credentials in GitHub repository nuxtlabs/github-module prior to 1.6.2.
Weakness: CWE-798
Which versions are affected by CVE-2023-2138?
2 open source packages ship an affected version, including @nuxtlabs/github-module. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@nuxtlabs/github-module npm | All versions | 1.6.2 |
@nuxtlabs/github-module npm | All versions | 1.6.2 |
Products include Nuxtlabs Nuxt.
How do I fix CVE-2023-2138?
Upgrade @nuxtlabs/github-module to 1.6.2 or later.
Is CVE-2023-2138 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-2138 exists.
Sources
Also known as GHSA-fp2w-g92g-fgq4.