{"id":"CVE-2023-50253","summary":"laf logs leak","details":"Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verify the permissions of the pod, which allows authenticated users to obtain any pod logs under the same namespace through this method, thereby obtaining sensitive information printed in the logs. As of time of publication, no known patched versions exist.","aliases":["GHSA-g9c8-wh35-g75f"],"modified":"2026-10-28T02:30:53.544170007Z","published":"2024-01-03T16:45:11.778Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-200"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50253.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/50xxx/CVE-2023-50253.json"},{"type":"ADVISORY","url":"https://github.com/labring/laf/security/advisories/GHSA-g9c8-wh35-g75f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50253"},{"type":"FIX","url":"https://github.com/labring/laf/pull/1468"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/labring/laf","events":[{"introduced":"241941d0b5ad5bac8a3cf5b86747b72216971558"},{"last_affected":"5844873a6a90602d39c889acd23b1fa4ab51cc1d"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"last_affected":"1.0.0-beta.13"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"cpe":"cpe:2.3:a:laf:laf:0.1.5:*:*:*:*:*:*:*","range":[{"introduced":"0.1.5"},{"last_affected":"0.1.5"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.4.0"},{"last_affected":"0.4.0"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.0:*:*:*:*:*:*:*"},{"range":[{"introduced":"0.4.1"},{"last_affected":"0.4.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.1:*:*:*:*:*:*:*"},{"range":[{"introduced":"0.4.2"},{"last_affected":"0.4.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.2:*:*:*:*:*:*:*"},{"range":[{"introduced":"0.4.3"},{"last_affected":"0.4.3"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.3:*:*:*:*:*:*:*"},{"range":[{"introduced":"0.4.4"},{"last_affected":"0.4.4"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.4:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.4.5:*:*:*:*:*:*:*","range":[{"introduced":"0.4.5"},{"last_affected":"0.4.5"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.4.6"},{"last_affected":"0.4.6"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.6:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.4.7:*:*:*:*:*:*:*","range":[{"introduced":"0.4.7"},{"last_affected":"0.4.7"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.4.8"},{"last_affected":"0.4.8"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.8:*:*:*:*:*:*:*"},{"range":[{"introduced":"0.4.9"},{"last_affected":"0.4.9"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.9:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.4.10:*:*:*:*:*:*:*","range":[{"introduced":"0.4.10"},{"last_affected":"0.4.10"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.4.11"},{"last_affected":"0.4.11"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.11:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.4.12:*:*:*:*:*:*:*","range":[{"introduced":"0.4.12"},{"last_affected":"0.4.12"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.4.13:*:*:*:*:*:*:*","range":[{"introduced":"0.4.13"},{"last_affected":"0.4.13"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.14:*:*:*:*:*:*:*","range":[{"introduced":"0.4.14"},{"last_affected":"0.4.14"}]},{"cpe":"cpe:2.3:a:laf:laf:0.4.15:*:*:*:*:*:*:*","range":[{"introduced":"0.4.15"},{"last_affected":"0.4.15"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.4.16"},{"last_affected":"0.4.16"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.4.16:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.4.17:*:*:*:*:*:*:*","range":[{"introduced":"0.4.17"},{"last_affected":"0.4.17"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.4.18:*:*:*:*:*:*:*","range":[{"introduced":"0.4.18"},{"last_affected":"0.4.18"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.4.19:*:*:*:*:*:*:*","range":[{"introduced":"0.4.19"},{"last_affected":"0.4.19"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.4.20:*:*:*:*:*:*:*","range":[{"introduced":"0.4.20"},{"last_affected":"0.4.20"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.5.0:-:*:*:*:*:*:*","range":[{"introduced":"0.5.0-NA"},{"last_affected":"0.5.0-NA"}]},{"range":[{"introduced":"0.5.1-NA"},{"last_affected":"0.5.1-NA"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.5.1:-:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.5.2:-:*:*:*:*:*:*","range":[{"introduced":"0.5.2-NA"},{"last_affected":"0.5.2-NA"}]},{"cpe":"cpe:2.3:a:laf:laf:0.5.3:*:*:*:*:*:*:*","range":[{"introduced":"0.5.3"},{"last_affected":"0.5.3"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.5.4:-:*:*:*:*:*:*","range":[{"introduced":"0.5.4-NA"},{"last_affected":"0.5.4-NA"}]},{"cpe":"cpe:2.3:a:laf:laf:0.5.5:-:*:*:*:*:*:*","range":[{"introduced":"0.5.5-NA"},{"last_affected":"0.5.5-NA"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.5.6:*:*:*:*:*:*:*","range":[{"introduced":"0.5.6"},{"last_affected":"0.5.6"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.5.7:-:*:*:*:*:*:*","range":[{"introduced":"0.5.7-NA"},{"last_affected":"0.5.7-NA"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.6.0:-:*:*:*:*:*:*","range":[{"introduced":"0.6.0-NA"},{"last_affected":"0.6.0-NA"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.6.1:*:*:*:*:*:*:*","range":[{"introduced":"0.6.1"},{"last_affected":"0.6.1"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.6.2:*:*:*:*:*:*:*","range":[{"introduced":"0.6.2"},{"last_affected":"0.6.2"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.6.3:*:*:*:*:*:*:*","range":[{"introduced":"0.6.3"},{"last_affected":"0.6.3"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.6.4"},{"last_affected":"0.6.4"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.4:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.5:*:*:*:*:*:*:*","range":[{"introduced":"0.6.5"},{"last_affected":"0.6.5"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.6:*:*:*:*:*:*:*","range":[{"introduced":"0.6.6"},{"last_affected":"0.6.6"}]},{"cpe":"cpe:2.3:a:laf:laf:0.6.7:*:*:*:*:*:*:*","range":[{"introduced":"0.6.7"},{"last_affected":"0.6.7"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.8:*:*:*:*:*:*:*","range":[{"introduced":"0.6.8"},{"last_affected":"0.6.8"}]},{"range":[{"introduced":"0.6.9"},{"last_affected":"0.6.9"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.9:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.6.10:*:*:*:*:*:*:*","range":[{"introduced":"0.6.10"},{"last_affected":"0.6.10"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.6.11"},{"last_affected":"0.6.11"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.11:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.6.12:*:*:*:*:*:*:*","range":[{"introduced":"0.6.12"},{"last_affected":"0.6.12"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.6.13:*:*:*:*:*:*:*","range":[{"introduced":"0.6.13"},{"last_affected":"0.6.13"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.6.14"},{"last_affected":"0.6.14"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.14:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.6.15:*:*:*:*:*:*:*","range":[{"introduced":"0.6.15"},{"last_affected":"0.6.15"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.6.16"},{"last_affected":"0.6.16"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.16:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.6.17:*:*:*:*:*:*:*","range":[{"introduced":"0.6.17"},{"last_affected":"0.6.17"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.18:*:*:*:*:*:*:*","range":[{"introduced":"0.6.18"},{"last_affected":"0.6.18"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.19:*:*:*:*:*:*:*","range":[{"introduced":"0.6.19"},{"last_affected":"0.6.19"}]},{"range":[{"introduced":"0.6.20"},{"last_affected":"0.6.20"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.20:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.21:*:*:*:*:*:*:*","range":[{"introduced":"0.6.21"},{"last_affected":"0.6.21"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.22:*:*:*:*:*:*:*","range":[{"introduced":"0.6.22"},{"last_affected":"0.6.22"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.6.23:*:*:*:*:*:*:*","range":[{"introduced":"0.6.23"},{"last_affected":"0.6.23"}]},{"cpe":"cpe:2.3:a:laf:laf:0.7.0:*:*:*:*:*:*:*","range":[{"introduced":"0.7.0"},{"last_affected":"0.7.0"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.7.1:*:*:*:*:*:*:*","range":[{"introduced":"0.7.1"},{"last_affected":"0.7.1"}]},{"cpe":"cpe:2.3:a:laf:laf:0.7.2:*:*:*:*:*:*:*","range":[{"introduced":"0.7.2"},{"last_affected":"0.7.2"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.7.3:*:*:*:*:*:*:*","range":[{"introduced":"0.7.3"},{"last_affected":"0.7.3"}]},{"range":[{"introduced":"0.7.4"},{"last_affected":"0.7.4"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.7.4:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.7.5:*:*:*:*:*:*:*","range":[{"introduced":"0.7.5"},{"last_affected":"0.7.5"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.7.6:*:*:*:*:*:*:*","range":[{"introduced":"0.7.6"},{"last_affected":"0.7.6"}]},{"cpe":"cpe:2.3:a:laf:laf:0.7.7:*:*:*:*:*:*:*","range":[{"introduced":"0.7.7"},{"last_affected":"0.7.7"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.7.8:*:*:*:*:*:*:*","range":[{"introduced":"0.7.8"},{"last_affected":"0.7.8"}]},{"cpe":"cpe:2.3:a:laf:laf:0.7.9:*:*:*:*:*:*:*","range":[{"introduced":"0.7.9"},{"last_affected":"0.7.9"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.7.10:*:*:*:*:*:*:*","range":[{"introduced":"0.7.10"},{"last_affected":"0.7.10"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.7.11:*:*:*:*:*:*:*","range":[{"introduced":"0.7.11"},{"last_affected":"0.7.11"}],"source":"CPE_STRING"},{"cpe":"cpe:2.3:a:laf:laf:0.8.0:-:*:*:*:*:*:*","range":[{"introduced":"0.8.0-NA"},{"last_affected":"0.8.0-NA"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.8.1"},{"last_affected":"0.8.1"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.1:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.2:*:*:*:*:*:*:*","range":[{"introduced":"0.8.2"},{"last_affected":"0.8.2"}]},{"cpe":"cpe:2.3:a:laf:laf:0.8.3:*:*:*:*:*:*:*","range":[{"introduced":"0.8.3"},{"last_affected":"0.8.3"}],"source":"CPE_STRING"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.4:*:*:*:*:*:*:*","range":[{"introduced":"0.8.4"},{"last_affected":"0.8.4"}]},{"range":[{"introduced":"0.8.5-NA"},{"last_affected":"0.8.5-NA"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.5:-:*:*:*:*:*:*"},{"range":[{"introduced":"0.8.6"},{"last_affected":"0.8.6"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.6:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.7:-:*:*:*:*:*:*","range":[{"introduced":"0.8.7-NA"},{"last_affected":"0.8.7-NA"}]},{"range":[{"introduced":"0.8.8"},{"last_affected":"0.8.8"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.8:*:*:*:*:*:*:*"},{"cpe":"cpe:2.3:a:laf:laf:0.8.9:*:*:*:*:*:*:*","range":[{"introduced":"0.8.9"},{"last_affected":"0.8.9"}],"source":"CPE_STRING"},{"range":[{"introduced":"0.8.10"},{"last_affected":"0.8.10"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.10:*:*:*:*:*:*:*"},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.11:*:*:*:*:*:*:*","range":[{"introduced":"0.8.11"},{"last_affected":"0.8.11"}]},{"source":"CPE_STRING","cpe":"cpe:2.3:a:laf:laf:0.8.12:*:*:*:*:*:*:*","range":[{"introduced":"0.8.12"},{"last_affected":"0.8.12"}]},{"cpe":"cpe:2.3:a:laf:laf:0.8.13:*:*:*:*:*:*:*","range":[{"introduced":"0.8.13"},{"last_affected":"0.8.13"}],"source":"CPE_STRING"}]}}],"versions":["0.1.5","0.4.0","0.4.1","0.4.10","0.4.11","0.4.12","0.4.13","0.4.14","0.4.15","0.4.16","0.4.17","0.4.18","0.4.19","0.4.2","0.4.20","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.4.8","0.4.9","0.5.0-NA","0.5.1-NA","0.5.2-NA","0.5.3","0.5.4-NA","0.5.5-NA","0.5.6","0.5.7-NA","0.6.0-NA","0.6.1","0.6.10","0.6.11","0.6.12","0.6.13","0.6.14","0.6.15","0.6.16","0.6.17","0.6.18","0.6.19","0.6.2","0.6.20","0.6.21","0.6.22","0.6.23","0.6.3","0.6.4","0.6.5","0.6.6","0.6.7","0.6.8","0.6.9","0.7.0","0.7.1","0.7.10","0.7.11","0.7.2","0.7.3","0.7.4","0.7.5","0.7.6","0.7.7","0.7.8","0.7.9","0.8.0-NA","0.8.1","0.8.10","0.8.11","0.8.12","0.8.13","0.8.2","0.8.3","0.8.4","0.8.5-NA","0.8.6","0.8.7-NA","0.8.8","0.8.9","v1.0.0-beta.13","v1.0.0-beta.12","v1.0.0-beta.11","v1.0.0-beta.10","v1.0.0-beta.9","v1.0.0-beta.8","v1.0.0-beta.7","v1.0.0-beta.6","v1.0.0-beta.5","v1.0.0-beta.4","v1.0.0-beta.3","v1.0.0-beta.2","v1.0.0-beta.1","v1.0.0-beta.0","v1.0.0-alpha.5","v1.0.0-alpha.4","v1.0.0-alpha.3","v1.0.0-alpha.2","v1.0.0-alpha.1","v1.0.0-alpha.0","v0.8.13","v0.8.12","v0.8.11","v0.8.10","v0.8.9","v0.8.8","v0.8.7","v0.8.7-alpha.3","v0.8.7-alpha.2","v0.8.7-alpha.1","v0.8.7-alpha.0","v0.8.6","v0.8.5","v0.8.5-alpha.0","v0.8.4","v0.8.3","v0.8.2","v0.8.1","v0.8.0","v0.8.0-alpha.11","v0.8.0-alpha.10","v0.8.0-alpha.9","v0.8.0-alpha.8","v0.8.0-alpha.7","v0.8.0-alpha.6","v0.8.0-alpha.5","v0.8.0-alpha.4","v0.8.0-alpha.3","v0.8.0-alpha.2","v0.8.0-alpha.1","v0.8.0-alpha.0","v0.7.11","v0.7.10","v0.7.9","v0.7.8","v0.7.7","v0.7.6","v0.7.5","v0.7.4","v0.7.3","v0.7.2","v0.7.1","v0.7.0","v0.6.23","v0.6.22","v0.6.21","v0.6.20","v0.6.19","v0.6.18","v0.6.17","v0.6.16","v0.6.15","v0.6.14","v0.6.13","v0.6.12","v0.6.11","v0.6.10","v0.6.9","v0.6.8","v0.6.7","v0.6.6","v0.6.5","v0.6.4","v0.6.3","v0.6.2","v0.6.1","v0.6.0","v0.6.0-alpha.10","v0.6.0-alpha.9","v0.6.0-alpha.8","v0.6.0-alpha.7","v0.6.0-alpha.6","v0.6.0-alpha.5","v0.6.0-alpha.4","v0.6.0-alpha.3","v0.6.0-alpha.2","v0.6.0-alpha.1","v0.6.0-alpha.0","v0.5.8-alpha.0","v0.5.7","v0.5.7-alpha.0","v0.5.6","v0.5.5","v0.5.5-alpha.0","v0.5.4","v0.5.4-alpha.0","v0.5.3","v0.5.2","v0.5.2-alpha.0","v0.5.1","v0.5.1-alpha.0","v0.5.0","v0.5.0-alpha.3","v0.5.0-alpha.2","v0.5.0-alpha.1","v0.4.21-alpha.0","v0.4.20","v0.4.19","v0.4.18","v0.4.17","v0.4.16","v0.4.15","v0.4.14","v0.4.13","v0.4.12","v0.4.11","v0.4.10","v0.4.9","v0.4.8","v0.4.7","v0.4.6","v0.4.5","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.4.0","laf-devops-server@0.0.4","laf-devops-admin@0.0.2","laf-app-server@0.2.7","laf-devops-server@0.0.3","laf-app-server@0.2.6","cloud-function-engine@0.0.6","laf-devops-server@0.0.2","laf-app-server@0.2.5","cloud-function-engine@0.0.5","node-modules-utils@0.0.5","less-api-framework@0.2.4","cloud-function-engine@0.0.4","node-modules-utils@0.0.4","less-api-framework@0.2.3","cloud-function-engine@0.0.3","node-modules-utils@0.0.3","less-api-framework@0.2.2","cloud-function@0.0.2","node-modules-utils@0.0.2","less-api-framework@0.2.1","v0.1.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-50253.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}