CyberRota Analysis
AI-GeneratedBudibase versions prior to 3.40.0 are vulnerable due to inadequate redaction of datasource credentials in STRING typed fields, exposing MongoDB connection strings and Firebase private keys in plaintext. This flaw allows authenticated users with table read permissions to access sensitive datasource configurations via the read API, potentially compromising backend database security. Organizations using Budibase should prioritize patching this vulnerability to mitigate the risk of credential exposure and unauthorized access to their databases.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Budibase before 3.40.0 fails to redact datasource credentials stored in STRING typed fields, allowing authenticated users to read MongoDB connection strings and Firebase private keys in plaintext. Attackers with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys.