CVE-2022-39292
Published: 10 October 2022
Summary
CVE-2022-39292 is a high-severity Exposure of Sensitive System Information Due to Uncleared Debug Information (CWE-1258) vulnerability in Slack Morphism Project Slack Morphism. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 39.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-7017
Vulnerability details
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks.…
more
As a workaround, people who use Slack webhooks may disable or filter debug logs.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.