CVE-2023-6944
Rhdh: catalog-import function leaks credentials to frontend
CVSS Score
5.7
EPSS Score
0.0%
EPSS Percentile
0th
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.
| CWE | CWE-209 |
| Vendor | red hat |
| Product | rhdh-1.1-rhel-9 |
| Published | Jan 4, 2024 |
| Last Updated | Nov 20, 2025 |
Stay Ahead of the Next One
Get instant alerts for red hat rhdh-1.1-rhel-9
Be the first to know when new medium vulnerabilities affecting red hat rhdh-1.1-rhel-9 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Red Hat / RHDH-1.1-RHEL-9
All versions affected References
Credits
Red Hat would like to thank Josephine Pfeiffer for reporting this issue.