Viper
Monthly
Hard-coded git credentials embedded in the distributed Docker image of FunnyWolf Viper up to and including version 3.1.11 are recoverable from the file /root/viper/.git/config, granting whoever obtains the image - or reaches a deployment that exposes the .git directory - access to the secrets stored there. Publicly available exploit code exists, published alongside a GitHub advisory and a VulDB submission, so the technique is trivially reproducible; there is no CISA KEV entry, so confirmed active exploitation in the wild is not established. With CVSS 4.0 scoring 5.5 (AV:N/PR:N/UI:N) but only LOW confidentiality impact and no integrity or availability effect, this is best treated as a low-to-moderate credential-disclosure issue rather than a pre-authentication remote compromise.
Hard-coded git credentials embedded in the distributed Docker image of FunnyWolf Viper up to and including version 3.1.11 are recoverable from the file /root/viper/.git/config, granting whoever obtains the image - or reaches a deployment that exposes the .git directory - access to the secrets stored there. Publicly available exploit code exists, published alongside a GitHub advisory and a VulDB submission, so the technique is trivially reproducible; there is no CISA KEV entry, so confirmed active exploitation in the wild is not established. With CVSS 4.0 scoring 5.5 (AV:N/PR:N/UI:N) but only LOW confidentiality impact and no integrity or availability effect, this is best treated as a low-to-moderate credential-disclosure issue rather than a pre-authentication remote compromise.