CVE-2023-47390 Headscale writes bearer tokens to info-level logs
Headscale writes sensitive bearer tokens to info-level logs, allowing attackers with log access to steal credentials and impersonate users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-47390?
CVE-2023-47390 is a high-severity vulnerability in n/a, published on 11 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Headscale through 0.22.3 writes bearer tokens to info-level logs.
Weakness: CWE-532
Which versions are affected by CVE-2023-47390?
2 open source packages ship an affected version, including github.com/juanfont/headscale. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/juanfont/headscale Go | All versions to 0.22.3 | None |
github.com/juanfont/headscale Go | All versions to 0.22.3 | None |
Products include Juanfont Headscale.
How do I fix CVE-2023-47390?
No fix has been published for CVE-2023-47390 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-47390 being exploited?
There is no known exploitation of CVE-2023-47390 in the wild and no public exploit code.
Sources
Also known as GHSA-wp76-cf2j-rqq7.