High severity · published Jul 22, 2022
CVE-2022-31162
Slack Morphism is an async client library for Rust
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive information in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurations in logs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SM
Slack Morphism · Slack Morphism Project
before 0.41.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-31162
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-31162
Release Notes
https://github.com/abdolence/slack-morphism-rust/releases/tag/v0.41.0
Third Party Advisory
https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-99j7-mhfh-w84p
More from Slack Morphism
7.5
CVE-2022-39292
Exposure of sensitive Slack webhook URLs in debug logs and traces
