Описание
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
A flaw was found in vm2. An attacker can exploit this vulnerability by improperly accessing the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable through globalThis. This allows the attacker to retrieve sensitive internal information from the sandbox environment, leading to information disclosure.
Отчет
This Moderate impact information disclosure vulnerability in vm2 allows attackers to access sensitive sandbox internals. However, Red Hat products are not affected by this flaw as the vulnerable code is not present in Red Hat's supported offerings.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Developer Hub | rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend | Not affected | ||
| Red Hat Developer Hub | rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend | Not affected | ||
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Not affected | ||
| Self-service automation portal 2 | ansible-automation-platform/automation-portal | Not affected | ||
| Self-service automation portal 2 | ansible-automation-platform/bootc-automation-portal-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
5.3 Medium
CVSS3