PT-2026-80889
CVE-2026-76054
·
تاريخ النشر
2026-08-24
·
تاريخ التحديث
2026-08-24
الوصف من
CVSS 4.0
7.1
عاليةالمقاييسAV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
blackduck-c-cpp versions 1.0.17 through 3.0.6
Description
An issue exists where an actor capable of executing code within the build of a scanned project can obtain the Black Duck API token. This occurs because the token is passed through the ambient process environment and inherited by subprocesses launched during build capture and signature scanning. This issue specifically affects configurations where the token is provided via the
BLACKDUCK API TOKEN or BD HUB TOKEN environment variables.Recommendations
Update blackduck-c-cpp to a version later than 3.0.6.
Rotate any API tokens that were supplied to affected versions through environment variables.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾