« Volver al listado

CVE-2025-31479

Estado: AplazadaAlta (8.2)—

canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated—causing part of the GITHUB_TOKEN to be displayed in plaintext in the GitHub Actions logs. Anyone with read access to the GitHub repository can view GitHub Actions logs.

Leer descripción completaMostrar menos

For public repositories, anyone can view the GitHub Actions logs. The opportunity to exploit this vulnerability is limited—the GITHUB_TOKEN is automatically revoked when the job completes. However, there is an opportunity for an attack in the time between the GITHUB_TOKEN being displayed in the logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1.0.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

CWE-532 (información sensible en logs); requiere PR:L y acceso a logs públicos. Token revelado en excepciones; explotable en ventana estrecha antes de revocación automática.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Password PoliciesVulnerability ScanningUser TrainingThreat Intelligence ProgramRestrict File and Directory PermissionsPrivileged Account Management

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Canonical — Get-workflow-version-actionAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-31479",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-31479",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-03T14:00:57.972059Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.8,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "canonical",
          "product": "get-workflow-version-action",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.0.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-04-02T22:15:20.563",
  "references": [
    {
      "url": "https://github.com/canonical/get-workflow-version-action/commit/88281a62e96e1c0ef4df30352ae0668a9f3e3369",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/canonical/get-workflow-version-action/issues/2",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/canonical/get-workflow-version-action/security/advisories/GHSA-26wh-cc3r-w6pj",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated—causing part of the GITHUB_TOKEN to be displayed in plaintext in the GitHub Actions logs. Anyone with read access to the GitHub repository can view GitHub Actions logs. For public repositories, anyone can view the GitHub Actions logs. The opportunity to exploit this vulnerability is limited—the GITHUB_TOKEN is automatically revoked when the job completes. However, there is an opportunity for an attack in the time between the GITHUB_TOKEN being displayed in the logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1.0.1."
    },
    {
      "lang": "es",
      "value": "Canonical/Get-Workflow-Version-Action es una acción compuesta de GitHub para obtener commit SHA con el que se llamó el flujo de trabajo reutilizable de GitHub. Antes de 1.0.1, si el paso Get-Workflow-Version-Action falla, la salida de excepción puede incluir el GitHub_Token. Si el token completo se incluye en la salida de excepción, GitHub redactará automáticamente el secreto de los registros de acciones de GitHub. Sin embargo, el token puede ser truncado, lo que se pone en la parte del GitHub_Token que se mostrará en texto plano en los registros de acciones de GitHub. Cualquier persona con acceso de lectura al repositorio de GitHub puede ver registros de acciones de GitHub. Para los repositorios públicos, cualquiera puede ver los registros de acciones de GitHub. La oportunidad de explotar esta vulnerabilidad es limitada: el GitHub_Token se revoca automáticamente cuando se completa el trabajo. Sin embargo, hay una oportunidad para un ataque en el tiempo entre el GitHub_Token que se muestra en los registros y la finalización del trabajo. Los usuarios que usan la entrada GitHub-Token se ven afectados. Esta vulnerabilidad se fija en 1.0.1."
    }
  ],
  "lastModified": "2026-06-17T09:10:28.450",
  "sourceIdentifier": "security-advisories@github.com"
}