Information Exposure Affecting slack-morphism package, versions <0.41.0


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.13% (49th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RUST-SLACKMORPHISM-2953400
  • published20 Jul 2022
  • disclosed20 Jul 2022
  • creditUnknown

Introduced: 20 Jul 2022

CVE-2022-31162  (opens in a new tab)
CWE-1258  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

Upgrade slack-morphism to version 0.41.0 or higher.

Overview

Affected versions of this package are vulnerable to Information Exposure of the OAuth client information in application debug logs.

Workarounds

If the user can't upgrade to the fixed version, it is recommended to not print output in logs request and responses for OAuth and client configurations.

References

CVSS Scores

version 3.1