GHSA-36rh-ggpr-j3gj: 
JavaScript vulnerability analysis and mitigation

A moderate severity vulnerability was identified in Renovate (npm package) affecting versions 19.180.0 to 23.25.1, discovered and disclosed on September 12, 2020. The vulnerability specifically impacts Azure DevOps users, where the bot's authentication token could potentially be exposed in server or pipeline logs (GitHub Advisory).

The vulnerability stems from the http.extraheader=AUTHORIZATION parameter being logged without proper redaction in the system logs. This technical oversight could lead to the exposure of sensitive authentication credentials (GitHub Advisory).

The vulnerability exclusively affects Azure DevOps users of Renovate. When exploited, it could lead to unauthorized access to the bot's credentials through exposed tokens in server or pipeline logs, potentially compromising the security of the affected systems (GitHub Advisory).

The vulnerability can be exploited if unauthorized users gain access to server or pipeline logs where the unredacted authentication tokens are stored. The risk is particularly significant in environments where logs are accessible to multiple users or stored in shared locations (GitHub Advisory).

The vulnerability has been patched in version 23.25.1. Users are strongly advised to upgrade to this version or later. Additionally, Azure DevOps users should revoke existing bot credentials and generate new ones after upgrading, particularly if there's a possibility that logs have been saved in locations accessible to others. As a temporary workaround, users should ensure Renovate logs are not shared with untrusted parties (GitHub Advisory).