5.7

CVE-2023-6944: linuxfoundation backstage

CVSS: 5.7v3.1MediumUndergoing analysis
AliasesGHSA-86rg-pf4c-5grg
Published 04-01-2024Last modified 20-11-2025
Open JSON

Vulnerability summary

CVE-2023-6944 is a medium (CVSS 5.7) vulnerability in linuxfoundation backstage. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.4% of scored vulnerabilities.

Overall risk
23/100
0100
Low · default modelHow is this calculated?
CVSS score
5.7/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.56%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 04-01-2024
    PublishedVulnerability first disclosed.
  2. 20-11-2025
    Last modifiedVulnerability information updated.

Description

A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline at the end of the string. The sanitized error can display on the frontend, including the raw access token. Upon gaining access to this token and depending on permissions, an attacker could push malicious code to repositories, delete resources in Git, revoke or generate new keys, and sign code illegitimately.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.56%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

0.00 pp

From 0.56% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.56%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

@backstage1 product
  • backend-app-api< 0.5.9-next.1
Linuxfoundation1 product
Redhat1 product

3 vendors · 3 products

References

10 links