{"cve":"CVE-2023-6944","nvd":{"published":"2024-01-04T10:15:11.517","modified":"2026-06-17T06:51:44.317","status":"Undergoing Analysis","description":"A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","score":5.7},"cwes":["CWE-209"],"references":["https://access.redhat.com/errata/RHBA-2024:5869","https://access.redhat.com/security/cve/CVE-2023-6944","https://bugzilla.redhat.com/show_bug.cgi?id=2255204","https://access.redhat.com/security/cve/CVE-2023-6944","https://bugzilla.redhat.com/show_bug.cgi?id=2255204"],"products":["linuxfoundation:backstage","redhat:red_hat_developer_hub"],"source":"nvd","synced_at":"2026-10-19T21:43:38.875533635+00:00"},"epss":{"cve":"CVE-2023-6944","score":0.00561,"percentile":0.46657,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-86rg-pf4c-5grg","url":"https://osv.dev/vulnerability/GHSA-86rg-pf4c-5grg","summary":"@backstage/backend-app-api leaks GitLab access tokens","modified":"2025-10-01T20:11:27Z","packages":[{"ecosystem":"npm","name":"@backstage/backend-app-api","purl":"pkg:npm/%40backstage/backend-app-api","ranges":["<0.5.9-next.1"],"fixed":["0.5.9-next.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}