CVE-2020-37267
HighCVSS 7.5Summary
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1.
Risk Assessment
The risk includes leakage of bot credentials, potentially leading to unauthorized access to repositories and data in Azure DevOps.
Recommendation
Upgrade Renovate to version 23.25.1 or later and, if logs may have been exposed, immediately revoke and regenerate credentials.
Original NVD description (English source)
Renovate versions >=19.180.0 and <23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed in 23.25.1; Azure DevOps users should revoke and regenerate credentials if logs may have been exposed.