CyberRota Analysis
AI-GeneratedThe @backstage/plugin-scaffolder-backend package prior to version 4.1.0 is vulnerable due to improper input validation in task list ordering, allowing authenticated users with appropriate permissions to infer confidential task data under specific conditions. The potential impact includes exposure of sensitive task information if certain criteria are met, including knowledge of task secrets and structure. Organizations using Backstage should prioritize upgrading to version 4.1.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0.
Related CVEs
Other vulnerabilities affecting the same vendor(s)