Search for vulnerabilities
Vulnerability details: VCID-zt3n-qgs4-aaam
Vulnerability ID VCID-zt3n-qgs4-aaam
Aliases CVE-2022-29810
GHSA-27rq-4943-qcwp
Summary The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-532 Insertion of Sensitive Information into Log File
System Score Found at
rhas Important https://access.redhat.com/errata/RHSA-2022:4956
rhas Important https://access.redhat.com/errata/RHSA-2022:5069
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5201
rhas Moderate https://access.redhat.com/errata/RHSA-2022:5392
rhas Important https://access.redhat.com/errata/RHSA-2022:6156
cvssv3 5.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29810.json
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00042 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00052 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00054 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00085 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
epss 0.00201 https://api.first.org/data/v1/epss?cve=CVE-2022-29810
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=2080279
cvssv3.1 8.4 https://github.com/hashicorp/go-getter
generic_textual HIGH https://github.com/hashicorp/go-getter
cvssv3.1 5.5 https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc
generic_textual MODERATE https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc
cvssv3.1 5.5 https://github.com/hashicorp/go-getter/pull/348
generic_textual MODERATE https://github.com/hashicorp/go-getter/pull/348
cvssv3.1 5.5 https://github.com/hashicorp/go-getter/releases/tag/v1.5.11
generic_textual MODERATE https://github.com/hashicorp/go-getter/releases/tag/v1.5.11
cvssv2 2.1 https://nvd.nist.gov/vuln/detail/CVE-2022-29810
cvssv3 5.5 https://nvd.nist.gov/vuln/detail/CVE-2022-29810
cvssv3.1 5.5 https://nvd.nist.gov/vuln/detail/CVE-2022-29810
cvssv3.1 5.5 https://pkg.go.dev/vuln/GO-2022-0438
generic_textual MODERATE https://pkg.go.dev/vuln/GO-2022-0438
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29810.json
https://api.first.org/data/v1/epss?cve=CVE-2022-29810
https://github.com/hashicorp/go-getter
https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc
https://github.com/hashicorp/go-getter/pull/348
https://github.com/hashicorp/go-getter/releases/tag/v1.5.11
https://pkg.go.dev/vuln/GO-2022-0438
2080279 https://bugzilla.redhat.com/show_bug.cgi?id=2080279
cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:*
CVE-2022-29810 https://nvd.nist.gov/vuln/detail/CVE-2022-29810
RHSA-2022:4956 https://access.redhat.com/errata/RHSA-2022:4956
RHSA-2022:5069 https://access.redhat.com/errata/RHSA-2022:5069
RHSA-2022:5201 https://access.redhat.com/errata/RHSA-2022:5201
RHSA-2022:5392 https://access.redhat.com/errata/RHSA-2022:5392
RHSA-2022:6156 https://access.redhat.com/errata/RHSA-2022:6156
No exploits are available.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-29810.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/hashicorp/go-getter
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/hashicorp/go-getter/commit/36b68b2f68a3ed10ee7ecbb0cb9f6b1dc5da49cc
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/hashicorp/go-getter/pull/348
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://github.com/hashicorp/go-getter/releases/tag/v1.5.11
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-29810
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-29810
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2022-29810
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Found at https://pkg.go.dev/vuln/GO-2022-0438
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.05128
EPSS Score 0.00042
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.