{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/212239?format=json","vulnerability_id":"VCID-7nuk-tv2c-g3fd","summary":"AWS SageMaker Training Toolkit logs CodeArtifact Authorization token","aliases":[{"alias":"GHSA-635v-pc42-fr74"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33341?format=json","purl":"pkg:pypi/sagemaker-training@4.8.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/sagemaker-training@4.8.0"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/33340?format=json","purl":"pkg:pypi/sagemaker-training@4.7.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-7nuk-tv2c-g3fd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/sagemaker-training@4.7.0"},{"url":"http://public2.vulnerablecode.io/api/packages/741171?format=json","purl":"pkg:pypi/sagemaker-training@4.7.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-7nuk-tv2c-g3fd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/sagemaker-training@4.7.1"},{"url":"http://public2.vulnerablecode.io/api/packages/741172?format=json","purl":"pkg:pypi/sagemaker-training@4.7.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-7nuk-tv2c-g3fd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/sagemaker-training@4.7.2"},{"url":"http://public2.vulnerablecode.io/api/packages/741173?format=json","purl":"pkg:pypi/sagemaker-training@4.7.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-7nuk-tv2c-g3fd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/sagemaker-training@4.7.3"},{"url":"http://public2.vulnerablecode.io/api/packages/741174?format=json","purl":"pkg:pypi/sagemaker-training@4.7.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-7nuk-tv2c-g3fd"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/sagemaker-training@4.7.4"}],"references":[{"reference_url":"https://github.com/aws/sagemaker-training-toolkit","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"},{"value":"5.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/sagemaker-training-toolkit"},{"reference_url":"https://github.com/aws/sagemaker-training-toolkit/commit/d8e56c90fa7fcc7421c0f7193bf9650fc2967213","reference_id":"","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"},{"value":"5.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/sagemaker-training-toolkit/commit/d8e56c90fa7fcc7421c0f7193bf9650fc2967213"},{"reference_url":"https://github.com/advisories/GHSA-635v-pc42-fr74","reference_id":"GHSA-635v-pc42-fr74","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-635v-pc42-fr74"},{"reference_url":"https://github.com/aws/sagemaker-training-toolkit/security/advisories/GHSA-635v-pc42-fr74","reference_id":"GHSA-635v-pc42-fr74","reference_type":"","scores":[{"value":"4.2","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N"},{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""},{"value":"5.6","scoring_system":"cvssv4","scoring_elements":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/aws/sagemaker-training-toolkit/security/advisories/GHSA-635v-pc42-fr74"}],"weaknesses":[{"cwe_id":532,"name":"Insertion of Sensitive Information into Log File","description":"Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information."},{"cwe_id":937,"name":"OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013."},{"cwe_id":1035,"name":"OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities","description":"Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017."}],"exploits":[],"severity_range_score":"4.0 - 6.9","exploitability":"0.5","weighted_severity":"6.2","risk_score":3.1,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-7nuk-tv2c-g3fd"}