-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| bbot | pip | < 2.7.0 | 2.7.2 |
| bbot | pip | >= 2.7.0.6919rc0, < 2.7.2 | 2.7.2 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in bbot's gitlab.py module, which improperly handled API key authentication for different GitLab instances. The module used a single mechanism to communicate with both gitlab.com and on-premise GitLab servers. This created a scenario where a globally configured gitlab.com API key could be leaked to an attacker-controlled on-premise GitLab instance during a scan. The root cause is the lack of domain validation before sending the sensitive API key. The fix involved separating the module into two distinct modules, one for gitlab.com and one for on-premise instances, to ensure that the gitlab.com API key is only sent to gitlab.com.
PythonPythonOngoing coverage of React2Shell