CVE-2023-48225
- Source
- https://cve.org/CVERecord?id=CVE-2023-48225
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-48225.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-48225
- Aliases
-
- GHSA-hv2g-gxx4-fwxp
- Published
- 2023-12-12T20:33:40.959Z
- Modified
- 2026-07-08T06:50:12.775503395Z
- Severity
-
- 8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
- Summary
- Laf env causes sensitive information disclosure
- Details
-
Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another obj, the name of the obj itself will be used as the key, and the entire object structure will be integrated intact. When constructing the deployment instance of the app, env was found from the database and directly inserted into the template, resulting in controllability here. Sensitive information in the secret and configmap can be read through the k8s envFrom field. In a privatization environment, when
namespaceConf. fixedis marked, it may lead to the leakage of sensitive information in the system. As of time of publication, it is unclear whether any patches or workarounds exist. - Database specific
{ "unresolved_ranges": [ { "source": "AFFECTED_FIELD", "extracted_events": [ { "fixed": "1.0.0-beta13" } ] } ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48225.json", "cwe_ids": [ "CWE-200" ], "cna_assigner": "GitHub_M" }- References
-
- https://github.com/labring/laf/blob/main/server/src/application/environment.controller.ts#L50
- https://github.com/labring/laf/blob/main/server/src/instance/instance.service.ts#L306
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48225.json
- https://github.com/labring/laf/security/advisories/GHSA-hv2g-gxx4-fwxp
- https://nvd.nist.gov/vuln/detail/CVE-2023-48225
Affected packages
Git / github.com/labring/laf
Affected ranges
- Type
- GIT
- Repo
- https://github.com/labring/laf
- Events
-
IntroducedLast affected
- Database specific
{ "source": "CPE_STRING", "cpe": [ "cpe:2.3:a:laf:laf:0.1.5:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.1:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.2:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.6:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.7:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.8:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.9:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.10:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.11:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.12:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.13:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.14:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.15:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.16:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.17:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.18:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.19:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.4.20:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.9:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.10:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.11:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.12:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.13:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.14:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.15:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.16:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.17:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.18:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.19:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.20:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.21:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.22:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.6.23:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.3:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.4:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.5:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.6:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.7:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.8:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.9:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.10:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.7.11:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.0:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.7:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.8:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.9:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.10:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.11:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.12:*:*:*:*:*:*:*", "cpe:2.3:a:laf:laf:0.8.13:*:*:*:*:*:*:*" ], "extracted_events": [ { "introduced": "0.1.5" }, { "last_affected": "0.1.5" }, { "introduced": "0.4.0" }, { "last_affected": "0.4.0" }, { "introduced": "0.4.1" }, { "last_affected": "0.4.1" }, { "introduced": "0.4.2" }, { "last_affected": "0.4.2" }, { "introduced": "0.4.3" }, { "last_affected": "0.4.3" }, { "introduced": "0.4.4" }, { "last_affected": "0.4.4" }, { "introduced": "0.4.5" }, { "last_affected": "0.4.5" }, { "introduced": "0.4.6" }, { "last_affected": "0.4.6" }, { "introduced": "0.4.7" }, { "last_affected": "0.4.7" }, { "introduced": "0.4.8" }, { "last_affected": "0.4.8" }, { "introduced": "0.4.9" }, { "last_affected": "0.4.9" }, { "introduced": "0.4.10" }, { "last_affected": "0.4.10" }, { "introduced": "0.4.11" }, { "last_affected": "0.4.11" }, { "introduced": "0.4.12" }, { "last_affected": "0.4.12" }, { "introduced": "0.4.13" }, { "last_affected": "0.4.13" }, { "introduced": "0.4.14" }, { "last_affected": "0.4.14" }, { "introduced": "0.4.15" }, { "last_affected": "0.4.15" }, { "introduced": "0.4.16" }, { "last_affected": "0.4.16" }, { "introduced": "0.4.17" }, { "last_affected": "0.4.17" }, { "introduced": "0.4.18" }, { "last_affected": "0.4.18" }, { "introduced": "0.4.19" }, { "last_affected": "0.4.19" }, { "introduced": "0.4.20" }, { "last_affected": "0.4.20" }, { "introduced": "0.5.0" }, { "last_affected": "0.5.0" }, { "introduced": "0.5.1" }, { "last_affected": "0.5.1" }, { "introduced": "0.5.2" }, { "last_affected": "0.5.2" }, { "introduced": "0.5.3" }, { "last_affected": "0.5.3" }, { "introduced": "0.5.4" }, { "last_affected": "0.5.4" }, { "introduced": "0.5.5" }, { "last_affected": "0.5.5" }, { "introduced": "0.5.6" }, { "last_affected": "0.5.6" }, { "introduced": "0.5.7" }, { "last_affected": "0.5.7" }, { "introduced": "0.6.0" }, { "last_affected": "0.6.0" }, { "introduced": "0.6.1" }, { "last_affected": "0.6.1" }, { "introduced": "0.6.2" }, { "last_affected": "0.6.2" }, { "introduced": "0.6.3" }, { "last_affected": "0.6.3" }, { "introduced": "0.6.4" }, { "last_affected": "0.6.4" }, { "introduced": "0.6.5" }, { "last_affected": "0.6.5" }, { "introduced": "0.6.6" }, { "last_affected": "0.6.6" }, { "introduced": "0.6.7" }, { "last_affected": "0.6.7" }, { "introduced": "0.6.8" }, { "last_affected": "0.6.8" }, { "introduced": "0.6.9" }, { "last_affected": "0.6.9" }, { "introduced": "0.6.10" }, { "last_affected": "0.6.10" }, { "introduced": "0.6.11" }, { "last_affected": "0.6.11" }, { "introduced": "0.6.12" }, { "last_affected": "0.6.12" }, { "introduced": "0.6.13" }, { "last_affected": "0.6.13" }, { "introduced": "0.6.14" }, { "last_affected": "0.6.14" }, { "introduced": "0.6.15" }, { "last_affected": "0.6.15" }, { "introduced": "0.6.16" }, { "last_affected": "0.6.16" }, { "introduced": "0.6.17" }, { "last_affected": "0.6.17" }, { "introduced": "0.6.18" }, { "last_affected": "0.6.18" }, { "introduced": "0.6.19" }, { "last_affected": "0.6.19" }, { "introduced": "0.6.20" }, { "last_affected": "0.6.20" }, { "introduced": "0.6.21" }, { "last_affected": "0.6.21" }, { "introduced": "0.6.22" }, { "last_affected": "0.6.22" }, { "introduced": "0.6.23" }, { "last_affected": "0.6.23" }, { "introduced": "0.7.0" }, { "last_affected": "0.7.0" }, { "introduced": "0.7.1" }, { "last_affected": "0.7.1" }, { "introduced": "0.7.2" }, { "last_affected": "0.7.2" }, { "introduced": "0.7.3" }, { "last_affected": "0.7.3" }, { "introduced": "0.7.4" }, { "last_affected": "0.7.4" }, { "introduced": "0.7.5" }, { "last_affected": "0.7.5" }, { "introduced": "0.7.6" }, { "last_affected": "0.7.6" }, { "introduced": "0.7.7" }, { "last_affected": "0.7.7" }, { "introduced": "0.7.8" }, { "last_affected": "0.7.8" }, { "introduced": "0.7.9" }, { "last_affected": "0.7.9" }, { "introduced": "0.7.10" }, { "last_affected": "0.7.10" }, { "introduced": "0.7.11" }, { "last_affected": "0.7.11" }, { "introduced": "0.8.0" }, { "last_affected": "0.8.0" }, { "introduced": "0.8.1" }, { "last_affected": "0.8.1" }, { "introduced": "0.8.2" }, { "last_affected": "0.8.2" }, { "introduced": "0.8.3" }, { "last_affected": "0.8.3" }, { "introduced": "0.8.4" }, { "last_affected": "0.8.4" }, { "introduced": "0.8.5" }, { "last_affected": "0.8.5" }, { "introduced": "0.8.6" }, { "last_affected": "0.8.6" }, { "introduced": "0.8.7" }, { "last_affected": "0.8.7" }, { "introduced": "0.8.8" }, { "last_affected": "0.8.8" }, { "introduced": "0.8.9" }, { "last_affected": "0.8.9" }, { "introduced": "0.8.10" }, { "last_affected": "0.8.10" }, { "introduced": "0.8.11" }, { "last_affected": "0.8.11" }, { "introduced": "0.8.12" }, { "last_affected": "0.8.12" }, { "introduced": "0.8.13" }, { "last_affected": "0.8.13" } ] }
Affected versions
0.*
0.1.5
0.4.0
0.4.1
0.4.10
0.4.11
0.4.12
0.4.13
0.4.14
0.4.15
0.4.16
0.4.17
0.4.18
0.4.19
0.4.2
0.4.20
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.4.8
0.4.9
0.5.0
0.5.1
0.5.2
0.5.3
0.5.4
0.5.5
0.5.6
0.5.7
0.6.0
0.6.1
0.6.10
0.6.11
0.6.12
0.6.13
0.6.14
0.6.15
0.6.16
0.6.17
0.6.18
0.6.19
0.6.2
0.6.20
0.6.21
0.6.22
0.6.23
0.6.3
0.6.4
0.6.5
0.6.6
0.6.7
0.6.8
0.6.9
0.7.0
0.7.1
0.7.10
0.7.11
0.7.2
0.7.3
0.7.4
0.7.5
0.7.6
0.7.7
0.7.8
0.7.9
0.8.0
0.8.1
0.8.10
0.8.11
0.8.12
0.8.13
0.8.2
0.8.3
0.8.4
0.8.5
0.8.6
0.8.7
0.8.8
0.8.9
cloud-function-engine@0.*
cloud-function-engine@0.0.3
cloud-function-engine@0.0.4
cloud-function-engine@0.0.5
cloud-function-engine@0.0.6
cloud-function@0.*
cloud-function@0.0.2
laf-app-server@0.*
laf-app-server@0.2.5
laf-app-server@0.2.6
laf-app-server@0.2.7
laf-devops-admin@0.*
laf-devops-admin@0.0.2
laf-devops-server@0.*
laf-devops-server@0.0.2
laf-devops-server@0.0.3
laf-devops-server@0.0.4
less-api-framework@0.*
less-api-framework@0.2.1
less-api-framework@0.2.2
less-api-framework@0.2.3
less-api-framework@0.2.4
node-modules-utils@0.*
node-modules-utils@0.0.2
node-modules-utils@0.0.3
node-modules-utils@0.0.4
node-modules-utils@0.0.5
v0.*
v0.1.5
v0.4.0
v0.4.1
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.15
v0.4.16
v0.4.17
v0.4.18
v0.4.19
v0.4.2
v0.4.20
v0.4.21-alpha.0
v0.4.3
v0.4.4
v0.4.5
v0.4.6
v0.4.7
v0.4.8
v0.4.9
v0.5.0
v0.5.0-alpha.1
v0.5.0-alpha.2
v0.5.0-alpha.3
v0.5.1
v0.5.1-alpha.0
v0.5.2
v0.5.2-alpha.0
v0.5.3
v0.5.4
v0.5.4-alpha.0
v0.5.5
v0.5.5-alpha.0
v0.5.6
v0.5.7
v0.5.7-alpha.0
v0.5.8-alpha.0
v0.6.0
v0.6.0-alpha.0
v0.6.0-alpha.1
v0.6.0-alpha.10
v0.6.0-alpha.2
v0.6.0-alpha.3
v0.6.0-alpha.4
v0.6.0-alpha.5
v0.6.0-alpha.6
v0.6.0-alpha.7
v0.6.0-alpha.8
v0.6.0-alpha.9
v0.6.1
v0.6.10
v0.6.11
v0.6.12
v0.6.13
v0.6.14
v0.6.15
v0.6.16
v0.6.17
v0.6.18
v0.6.19
v0.6.2
v0.6.20
v0.6.21
v0.6.22
v0.6.23
v0.6.3
v0.6.4
v0.6.5
v0.6.6
v0.6.7
v0.6.8
v0.6.9
v0.7.0
v0.7.1
v0.7.10
v0.7.11
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.0-alpha.0
v0.8.0-alpha.1
v0.8.0-alpha.10
v0.8.0-alpha.11
v0.8.0-alpha.2
v0.8.0-alpha.3
v0.8.0-alpha.4
v0.8.0-alpha.5
v0.8.0-alpha.6
v0.8.0-alpha.7
v0.8.0-alpha.8
v0.8.0-alpha.9
v0.8.1
v0.8.10
v0.8.11
v0.8.12
v0.8.13
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.8.5-alpha.0
v0.8.6
v0.8.7
v0.8.7-alpha.0
v0.8.7-alpha.1
v0.8.7-alpha.2
v0.8.7-alpha.3
v0.8.8
v0.8.9