What is GHSA-fp2w-g92g-fgq4?

GHSA-fp2w-g92g-fgq4 is a security advisory published by GitHub Security Advisories with Critical severity. @nuxtlabs/github-module made Use of Hard-coded Credentials

Which CVE IDs does GHSA-fp2w-g92g-fgq4 cover?

GHSA-fp2w-g92g-fgq4 covers the following CVE IDs: CVE-2023-2138. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fp2w-g92g-fgq4?

GHSA-fp2w-g92g-fgq4 has a CVSS v3 base score of 10.0, published by GitHub Security Advisories.

Which products are affected by GHSA-fp2w-g92g-fgq4?

GHSA-fp2w-g92g-fgq4 affects 1 product, including: npm/@nuxtlabs/github-module:\u003c 1.6.2.

GHSA-fp2w-g92g-fgq4CriticalCVSS 10.0

@nuxtlabs/github-module made Use of Hard-coded Credentials

Vendor

GitHub Security Advisories

Published

April 18, 2023

Last Modified

November 12, 2023

🔗 CVE IDs covered (1)

CVE-2023-2138 →

📋 Description

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under nuxt, nuxtlabs and nuxt-themes GitHub organizations. A patch in version 1.6.2 fixed the issue.

🎯 Affected products1

npm/@nuxtlabs/github-module:< 1.6.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-2138
https://github.com/nuxtlabs/github-module/commit/5490c43f729eee60f07920bf88c0aabdc1398b6e
https://huntr.dev/bounties/65096ef9-eafc-49da-b49a-5b88c0203ca6
https://github.com/nuxtlabs/github-module/releases/tag/v1.6.2
https://github.com/advisories/GHSA-fp2w-g92g-fgq4