Riskcovery

CVE-2022-31162

Slack Morphism for Rust before 0.41.0 can accidentally leak Slack OAuth client information in application debug logs

State
Published
Severity
7.5 High
Published
Jul 21, 2022
Updated
Apr 23, 2025
Reserved
May 18, 2022

Read the record on cve.org

Description

Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stricter and more secure debug formatting was introduced in v0.41.0 for OAuth secret types to reduce the possibility of printing sensitive information in application logs. As a workaround, do not print/output requests and responses for OAuth and client configurations in logs.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NGitHub_M

Weaknesses

  • CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

ProductVersions
slack-morphism-rustabdolence
  • < 0.41.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.