Sensitive information disclosure via log in com.bmuschko:gradle-vagrant-plugin

中 6.5CVE-2021-21361 · GHSA-jpcm-4485-69p7 · 09/03/2021 公開 · 17/06/2026 更新

要点

CVE-2021-21361 は com.bmuschko:gradle-vagrant-plugin, vagrant (vagrant project) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.2%（全脆弱性の 67.8% より高い）。
対処：3.0.0, 0.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
com.bmuschko:gradle-vagrant-plugin Maven	`≥ 0.6, < 3.0.0`	`3.0.0`
vagrant vagrant_project	`≥ 2.0, < 3.0.0< 0.6`	`3.0.00.6`

概要

Impact

The com.bmuschko:gradle-vagrant-plugin Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables.

When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors.

Patches

Fixed in version 3.0.0

References

For more information

If you have any questions or comments about this advisory:

Open an issue in bmuschko/gradle-vagrant-plugin

NVD の説明

The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to the logging of the system environment variables. When this Gradle plugin is executed in public CI/CD, this can lead to sensitive credentials being exposed to malicious actors. This is fixed in version 3.0.0.