Para Multitenant Backend Access and Secret Key Exposure Vulnerability

A vulnerability in Para, a multitenant backend server/framework for object persistence and retrieval, allows access and secret keys to be logged without redaction in versions prior to 1.50.8. This unredacted logging occurs during the server initialization process and exposes sensitive credentials that are later reused in variable assignments for persistence, despite not being necessary for debugging or system health monitoring. The issue has been addressed in version 1.50.8.

Impact

Exposed access and secret keys in logs, creating a risk of unauthorized access or manipulation of persistent data.

Remediation

Users can upgrade to Para version 1.50.8 to address this vulnerability.