← CVE Intelligence

CVE-2022-3474

Bazel leaks user credentials through the remote assets API PUBLISHED

Description (CNA)

A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.

Affected (CNA)

Vendor / productVersions
Google LLC / Bazelaffected 5.0.0 before 5.3.2; affected 4.0.0 before 4.2.3; affected 3.0.0 before 3.7.2

CWE

CWE-522

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.