Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

@backstage/plugin-app-backend

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9npmAmendedPublished

    Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

    CVE-2024-47762 · GHSA-qc4v-xq2m-65wc

    Affected
    • npm @backstage/plugin-app-backend < 0.3.75
    Fixed in
    0.3.75· Vendor fix available
    Issue
    Impact Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema specified that they should have backend or secret visibility. This was an intended feature of the APPCONFIG way of supplying configuration, but now clearly goes against the expected behavior of the configuration system. This behavior leads to a risk of potentially exposing sensitive configuration details intended to remain private or restricted to backend processes. Patches The issue has been resolved in version 0.3.75 of the @backstage/plugin-app-backend package. Users are encouraged to upgrade to this version to mitigate the vulnerability. Workarounds As a temporary measure, avoid supplying secrets using the APPCONFIG configuration pattern. Consider alternative methods for setting secrets, such as the environment substitution available for…

    Recommended action: Upgrade to 0.3.75 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →