Gratipay rails secret token (secret_key_base) publicly exposed in GitHub

信息泄露 / 敏感信息明文存储 / #262620

厂商

Gratipay

严重程度

低危

赏金

—

弱点

敏感信息明文存储

研究员

@sp4rrow

披露日期

2017-08-23

资产

https://github.com/gratipay/bot

CVE

—

该报告还没有中文解读。

Summary Gratipay's Rails secret token is publicly exposed on GitHub. Knowing the secret token allows an attacker to impersonate any user in the application.