[GHSA-x6gv-2rvh-qmp6] m00nl1ght-dev/steam-workshop-deploy: Exposure of Version-Control Repository to an Unauthorized Control Sphere and Insufficiently Protected Credentials

[Gamebuster19901]

Updates

• CWEs
• References
• Source code location

Comments
BoldestDungeon repo is a downstream fork. The issue originated in m00nl1ght-dev/steam-workshop-deploy.

Also added missing CWEs

[github]

Hi there @BoldestDungeon! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Gamebuster19901]

@m00nl1ght-dev pinging you per the above comment if you have anything to add, since you're the project owner.

[shelbyc]

Hi @Gamebuster19901, I think adding m00nl1ght-dev/steam-workshop-deploy@913f084 as a reference link and some CWEs makes sense so am incorporating the changes into the global advisory for GHSA-x6gv-2rvh-qmp6. The conversation can, of course, continue here if there are aspects of the advisory that still need to be discussed.

[advisory-database]

Hi @Gamebuster19901! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!