Read the docs

runatlantis

Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high5CVSS 7.0–8.9

Exploited now

runatlantis records in CISA KEV

No runatlantis vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Atlantis 3 records HIGH

Records

3 records in Atlantis · all components

TI-2024-34896 CVE-2024-52009 · GHSA-gppm-hq3p-h4rp

Git credentials are exposed in atlantis logs

Priority LOW 38

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks.

CVSS 4.0HIGH 8.5 Network Low privileges No interaction EPSS 0.00718 Published 2024-11-08 Fixed in 0.30.0 CWE-532
TI-2022-08720 CVE-2022-24912 · GHSA-jxqv-jcvh-7gr4

Timing Attack

Priority LOW 35

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 are vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01215 Published 2022-07-29 Fixed in 0.19.7 CWE-203
Open these records in search →