CVE-2025-31479

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-31479", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-03-28T13:36:51.297Z", "datePublished": "2025-04-02T21:09:34.354Z", "dateUpdated": "2025-04-03T14:01:08.763Z"}, "containers": {"cna": {"title": "canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output", "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/canonical/get-workflow-version-action/security/advisories/GHSA-26wh-cc3r-w6pj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/canonical/get-workflow-version-action/security/advisories/GHSA-26wh-cc3r-w6pj"}, {"name": "https://github.com/canonical/get-workflow-version-action/issues/2", "tags": ["x_refsource_MISC"], "url": "https://github.com/canonical/get-workflow-version-action/issues/2"}, {"name": "https://github.com/canonical/get-workflow-version-action/commit/88281a62e96e1c0ef4df30352ae0668a9f3e3369", "tags": ["x_refsource_MISC"], "url": "https://github.com/canonical/get-workflow-version-action/commit/88281a62e96e1c0ef4df30352ae0668a9f3e3369"}], "affected": [{"vendor": "canonical", "product": "get-workflow-version-action", "versions": [{"version": "< 1.0.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-02T21:09:34.354Z"}, "descriptions": [{"lang": "en", "value": "canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated\u2014causing part of the GITHUB_TOKEN to be displayed in plaintext in the GitHub Actions logs. Anyone with read access to the GitHub repository can view GitHub Actions logs. For public repositories, anyone can view the GitHub Actions logs. The opportunity to exploit this vulnerability is limited\u2014the GITHUB_TOKEN is automatically revoked when the job completes. However, there is an opportunity for an attack in the time between the GITHUB_TOKEN being displayed in the logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1.0.1."}], "source": {"advisory": "GHSA-26wh-cc3r-w6pj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-03T14:00:57.972059Z", "id": "CVE-2025-31479", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-03T14:01:08.763Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-31479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-03T14:00:57.972059Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-03T14:01:03.357Z"}}], "cna": {"title": "canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output", "source": {"advisory": "GHSA-26wh-cc3r-w6pj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "canonical", "product": "get-workflow-version-action", "versions": [{"status": "affected", "version": "< 1.0.1"}]}], "references": [{"url": "https://github.com/canonical/get-workflow-version-action/security/advisories/GHSA-26wh-cc3r-w6pj", "name": "https://github.com/canonical/get-workflow-version-action/security/advisories/GHSA-26wh-cc3r-w6pj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/canonical/get-workflow-version-action/issues/2", "name": "https://github.com/canonical/get-workflow-version-action/issues/2", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/canonical/get-workflow-version-action/commit/88281a62e96e1c0ef4df30352ae0668a9f3e3369", "name": "https://github.com/canonical/get-workflow-version-action/commit/88281a62e96e1c0ef4df30352ae0668a9f3e3369", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated\u2014causing part of the GITHUB_TOKEN to be displayed in plaintext in the GitHub Actions logs. Anyone with read access to the GitHub repository can view GitHub Actions logs. For public repositories, anyone can view the GitHub Actions logs. The opportunity to exploit this vulnerability is limited\u2014the GITHUB_TOKEN is automatically revoked when the job completes. However, there is an opportunity for an attack in the time between the GITHUB_TOKEN being displayed in the logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1.0.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-04-02T21:09:34.354Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31479", "state": "PUBLISHED", "dateUpdated": "2025-04-03T14:01:08.763Z", "dateReserved": "2025-03-28T13:36:51.297Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-04-02T21:09:34.354Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "get-workflow-version-action", "vendor": "canonical", "versions": [{"status": "affected", "version": "< 1.0.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if the get-workflow-version-action step fails, the exception output may include the GITHUB_TOKEN. If the full token is included in the exception output, GitHub will automatically redact the secret from the GitHub Actions logs. However, the token may be truncated\u2014causing part of the GITHUB_TOKEN to be displayed in plaintext in the GitHub Actions logs. Anyone with read access to the GitHub repository can view GitHub Actions logs. For public repositories, anyone can view the GitHub Actions logs. The opportunity to exploit this vulnerability is limited\u2014the GITHUB_TOKEN is automatically revoked when the job completes. However, there is an opportunity for an attack in the time between the GITHUB_TOKEN being displayed in the logs and the completion of the job. Users using the github-token input are impacted. This vulnerability is fixed in 1.0.1."}, {"lang": "es", "value": "Canonical/Get-Workflow-Version-Action es una acci\u00f3n compuesta de GitHub para obtener commit SHA con el que se llam\u00f3 el flujo de trabajo reutilizable de GitHub. Antes de 1.0.1, si el paso Get-Workflow-Version-Action falla, la salida de excepci\u00f3n puede incluir el GitHub_Token. Si el token completo se incluye en la salida de excepci\u00f3n, GitHub redactar\u00e1 autom\u00e1ticamente el secreto de los registros de acciones de GitHub. Sin embargo, el token puede ser truncado, lo que se pone en la parte del GitHub_Token que se mostrar\u00e1 en texto plano en los registros de acciones de GitHub. Cualquier persona con acceso de lectura al repositorio de GitHub puede ver registros de acciones de GitHub. Para los repositorios p\u00fablicos, cualquiera puede ver los registros de acciones de GitHub. La oportunidad de explotar esta vulnerabilidad es limitada: el GitHub_Token se revoca autom\u00e1ticamente cuando se completa el trabajo. Sin embargo, hay una oportunidad para un ataque en el tiempo entre el GitHub_Token que se muestra en los registros y la finalizaci\u00f3n del trabajo. Los usuarios que usan la entrada GitHub-Token se ven afectados. Esta vulnerabilidad se fija en 1.0.1."}], "id": "CVE-2025-31479", "lastModified": "2026-06-17T09:10:28.450", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-31479", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-04-03T14:00:57.972059Z", "version": "2.0.3"}}]}, "published": "2025-04-02T22:15:20.563", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/canonical/get-workflow-version-action/commit/88281a62e96e1c0ef4df30352ae0668a9f3e3369"}, {"source": "security-advisories@github.com", "url": "https://github.com/canonical/get-workflow-version-action/issues/2"}, {"source": "security-advisories@github.com", "url": "https://github.com/canonical/get-workflow-version-action/security/advisories/GHSA-26wh-cc3r-w6pj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{}