High severity · published Oct 10, 2022
CVE-2022-39292
Exposure of sensitive Slack webhook URLs in debug logs and traces
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slack webhooks may disable or filter debug logs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
slack-morphism-rust · abdolence
<= 1.3.0 · source: vendor
SM
Slack Morphism · Slack Morphism Project
through 1.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-39292
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-39292
Release Notes
https://github.com/abdolence/slack-morphism-rust/releases/tag/v1.3.2
Third Party Advisory
https://github.com/abdolence/slack-morphism-rust/security/advisories/GHSA-4mjx-2gh5-ph8h
More from slack-morphism-rust
5.3
CVE-2026-113799
Slack Morphism verifier errors disclose valid HMACs in the logs