Bazel supply chain vulnerability
Published Wed, Apr 3rd, 2024
Platforms
Summary
Cycode discovered a CI/CD misconfiguration in the Bazel repo, which if exploited could have allowed an attacker to enact a supply chain attack against all Bazel users, which includes Google themselves and therefore likely GCP as well.
Affected Services
N/A
Tracked CVEs
No tracked CVEs
References
Entry Status
Stub
Disclosure Date
-
Exploitability Period
-
Known ITW Exploitation
-
Detection Methods
None
Piercing Index Rating
-
Discovered by
Cycode
