CVE-2022-39292 json
Exposure of sensitive Slack webhook URLs in debug logs and traces
published 2022-10-10 4 y ago modified 2026-06-17 4 mo ago also GHSA-4mjx-2gh5-ph8h , RUSTSEC-2022-0087 , EUVD-2022-7017
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain private information. The problem is fixed in version 1.3.2 which redacts sensitive URLs for webhooks. As a workaround, people who use Slack webhooks may disable or filter debug logs.
Patch / fix
- crates.io slack-morphism 1.3.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | slack-morphism | <1.3.2 >=0.0.0-0, <1.3.2 |
1.3.2 |
Affected products
- abdolence slack-morphism-rust
Classification
- Weakness
-
- CWE-1258 Exposure of Sensitive System Information Due to Uncleared Debug Information
References
-
github.com
/abdolence/slack-morphism-rust/commit/48a1da2dc2ad3a5ccc60036d43f6f8fbb2c15f1d
web
-
github.com
/abdolence/slack-morphism-rust/commit/65ef9fac4f39c4e171e2952a6cf029bb0d059a89
web
-
github.com
/abdolence/slack-morphism-rust/security/advisories/GHSA-4mjx-2gh5-ph8h
web, third-party-advisory
-
github.com
/abdolence/slack-morphism-rust/releases/tag/v1.3.2
web, release-notes, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2022-39292
advisory
-
github.com
/abdolence/slack-morphism-rust
package
-
rustsec.org
/advisories/RUSTSEC-2022-0087.html
web, advisory
-
crates.io
/crates/slack-morphism
package
Sources
- CVE List CVE-2022-39292
- GitHub Advisory GHSA-4mjx-2gh5-ph8h
- NVD CVE-2022-39292
- OSV RUSTSEC-2022-0087
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.