Basic-auth app bundle credential exposure in gatsby-source-wordpress

Description

The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected.

Recommendation

Update the gatsby-source-wordpress package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.9.2

  < 4.0.8**

• Patched version(s): **5.9.2

  4.0.8**

References

• GHSA-rqjw-p5vr-c695
• CVE-2021-32770
• CWE-200
• CWE-522
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Follow Redirects improperly handles URLs in the url.parse() function - CVE-2023-26159
• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• AngularJS allows attackers to bypass common image source restrictions - CVE-2024-8372
• Strapi Allows Unauthorized Access to Private Fields via parms.lookup - CVE-2024-56143

Tags:

npm

gatsby-source-wordpress