Renovate before 44.11.3 Credential Exfiltration via Link Header
Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructure to exfiltrate authentication credentials.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
renovate
Vendor
renovatebot
Product
renovate
Platforms
Unknown
Default status
unaffected
renovate · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
44.11.3
Unavailable
None listed
44.11.3
unaffected
semver
Unavailable
Unavailable
None listed
renovate-ce
Vendor
mend
Product
renovate-ce
Platforms
Unknown
Default status
unaffected
renovate-ce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.4.0
Unavailable
None listed
15.4.0
unaffected
semver
Unavailable
Unavailable
None listed
renovate-ee-server
Vendor
mend
Product
renovate-ee-server
Platforms
Unknown
Default status
unaffected
renovate-ee-server · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.4.0
Unavailable
None listed
15.4.0
unaffected
semver
Unavailable
Unavailable
None listed
renovate-ee-worker
Vendor
mend
Product
renovate-ee-worker
Platforms
Unknown
Default status
unaffected
renovate-ee-worker · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.4.0
Unavailable
None listed
15.4.0
unaffected
semver
Unavailable
Unavailable
None listed
mend-renovate-ce
Vendor
mend
Product
mend-renovate-ce
Platforms
Unknown
Default status
unaffected
mend-renovate-ce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
15.4.0
Unavailable
None listed
15.4.0
unaffected
semver
Unavailable
Unavailable
None listed
mend-renovate-enterprise-edition
Vendor
mend
Product
mend-renovate-enterprise-edition
Platforms
Unknown
Default status
unaffected
mend-renovate-enterprise-edition · Scoped product and version facts