GHSA-ghgq-x6wc-6jr5

Zowe CLI allows storage of previously entered secure credentials in a plaintext file

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-6833

Packages

Ecosystem	Package	Affected	Fixed in
npm	@zowe/cli	>= 7.18.0, < 7.23.5	7.23.5

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability in Zowe CLI allows local, privileged actors to store previously entered secure credentials in a plaintext file as part of an auto-init operation.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-6833 advisory
https://github.com/zowe/zowe-cli/commit/6778da5e03c65dfcd3e6e4b4097b94d9fbd5d01b web
https://github.com/zowe/zowe-cli package