CVE-2023-25164
Summary
| CVE | CVE-2023-25164 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-02-08 20:15:00 UTC |
| Updated | 2023-02-18 21:48:00 UTC |
| Description | Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli >= 1.0.0 && < 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a version prior to 1.0.0 this vulnerability does not affect you. If you are affected and your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately. This issue has been patched in @tinacms/[email protected]. Users are advised to upgrade. There are no known workarounds for this issue. |
Risk And Classification
Problem Types: CWE-200 | CWE-532
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Only expose `NEXT_PUBLIC_*` and `TINA_PUBLIC_*` ENV vars by logan-anderson · Pull Request #3584 · tinacms/tinacms · GitHub | MISC | github.com | |
| Sensitive Information leak via Script File in TinaCMS · Advisory · tinacms/tinacms · GitHub | MISC | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.