CVE-2023-44312 Apache ServiceComb Service-Center: attacker can query all environment variables of the service-center server
An attacker can query all environment variables of the Apache ServiceComb Service-Center server, exposing sensitive configuration data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-44312?
CVE-2023-44312 is a medium-severity vulnerability in Apache ServiceComb Service-Center, published on 31 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Exposure of Sensitive Information to an Unauthorized Actor in Apache ServiceComb Service-Center.This issue affects
Apache ServiceComb Service-Center
before 2.1.0 (include).
Users are recommended to upgrade to version 2.2.0, which fixes the issue.
Weakness: CWE-200
Which versions are affected by CVE-2023-44312?
3 open source packages ship an affected version, including github.com/apache/servicecomb-service-center. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/apache/servicecomb-service-center Go | All versions | None |
github.com/apache/servicecomb-service-center Go | All versions | 2.2.0 |
github.com/apache/servicecomb-service-center Go | All versions | 2.2.0 |
Products include Apache Servicecomb.
How do I fix CVE-2023-44312?
Upgrade github.com/apache/servicecomb-service-center to 2.2.0 or later.
Is CVE-2023-44312 being exploited?
There is no known exploitation of CVE-2023-44312 in the wild and no public exploit code.
Other vulnerabilities in Apache ServiceComb Service-Center
Sources
Also known as GHSA-r8xp-52mq-rmm8, GO-2024-2496.