Information Exposure in jaeger · CVE-2020-10750 · GitHub Advisory Database · GitHub

Information Exposure in jaeger

Moderate severity GitHub Reviewed Published May 18, 2021 to the GitHub Advisory Database • Updated Sep 15, 2023

Package

github.com/jaegertracing/jaeger (Go)

Affected versions

< 1.18.1

Patched versions

1.18.1

Description

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.

References

Reviewed May 12, 2021

Published to the GitHub Advisory Database May 18, 2021

Last updated Sep 15, 2023

Severity

Moderate

5.5

/ 10

CVSS base metrics

Attack vector

Local

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N