CVE-2021-21361 - Vulnerability Details - OpenCVE

The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Adjacent Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:A/AC:L/Au:N/C:P/I:N/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vagrant Project	Vagrant

Configuration 1 [-]

OR	cpe:2.3:a:vagrant_project:vagrant::::::gradle::*
	cpe:2.3:a:vagrant_project:vagrant::::::gradle::*

No data.

References

Link	Providers
https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7
https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44
https://github.com/bmuschko/gradle-vagrant-plugin/issues/19
https://github.com/bmuschko/gradle-vagrant-plugin/pull/20

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2021-03-09T00:40:18

Updated: 2024-08-03T18:09:15.934Z

Reserved: 2020-12-22T00:00:00

Link: CVE-2021-21361

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-03-09T01:15:13.230

Modified: 2024-11-21T05:48:11.877

Link: CVE-2021-21361

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "security-research", "vendor": "JLLeitschuh", "versions": [{"status": "affected", "version": "< 3.0.0"}]}], "descriptions": [{"lang": "en", "value": "The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-03-09T00:40:17", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/issues/19"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/pull/20"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44"}], "source": {"advisory": "GHSA-jpcm-4485-69p7", "discovery": "UNKNOWN"}, "title": "Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2021-21361", "STATE": "PUBLIC", "TITLE": "Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "security-research", "version": {"version_data": [{"version_value": "< 3.0.0"}]}}]}, "vendor_name": "JLLeitschuh"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-532: Insertion of Sensitive Information into Log File"}]}]}, "references": {"reference_data": [{"name": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7", "refsource": "CONFIRM", "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7"}, {"name": "https://github.com/bmuschko/gradle-vagrant-plugin/issues/19", "refsource": "MISC", "url": "https://github.com/bmuschko/gradle-vagrant-plugin/issues/19"}, {"name": "https://github.com/bmuschko/gradle-vagrant-plugin/pull/20", "refsource": "MISC", "url": "https://github.com/bmuschko/gradle-vagrant-plugin/pull/20"}, {"name": "https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44", "refsource": "MISC", "url": "https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44"}]}, "source": {"advisory": "GHSA-jpcm-4485-69p7", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:09:15.934Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/issues/19"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/pull/20"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2021-21361", "datePublished": "2021-03-09T00:40:18", "dateReserved": "2020-12-22T00:00:00", "dateUpdated": "2024-08-03T18:09:15.934Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vagrant_project:vagrant:*:*:*:*:*:gradle:*:*", "matchCriteriaId": "3AFF2CD1-56CD-4765-AF25-F7B928781487", "versionEndExcluding": "0.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:vagrant_project:vagrant:*:*:*:*:*:gradle:*:*", "matchCriteriaId": "CF491479-EB43-4F2A-8BDC-5BFB58D25AC4", "versionEndExcluding": "3.0.0", "versionStartIncluding": "2.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0."}, {"lang": "es", "value": "El plugin de Gradle \"com.bmuschko: gradle-vagrant-plugin\" contiene una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n debido al registro de las variables de entorno del sistema. Cuando este plugin de Gradle se ejecuta en CI/CD p\u00fablico, esto puede conllevar a que las credenciales confidenciales se expongan a actores maliciosos. Esto se corrige en la versi\u00f3n 3.0.0"}], "id": "CVE-2021-21361", "lastModified": "2024-11-21T05:48:11.877", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 3.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 6.5, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-03-09T01:15:13.230", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/issues/19"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/pull/20"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/JLLeitschuh/security-research/security/advisories/GHSA-jpcm-4485-69p7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/blob/292129f9343d00d391543fae06239e9b0f33db73/src/main/groovy/com/bmuschko/gradle/vagrant/process/GDKExternalProcessExecutor.groovy#L42-L44"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/issues/19"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/bmuschko/gradle-vagrant-plugin/pull/20"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}