Information Disclosure in Replicated Classic by Replicated

CVE-2021-42718

What is CVE-2021-42718?

The Replicated Classic software versions prior to 2.53.1 contain a vulnerability in the Admin Console API that could allow authenticated users with Admin access to expose sensitive information, such as application secrets. This occurs via access to container definitions that include environment variables, potentially leading to the retrieval of passwords and other sensitive data. The vulnerability was discovered during a security review in September 2021 and was promptly addressed by modifying the API to eliminate the exposure of sensitive information. Affected users should upgrade to the supported version to mitigate this risk.

References