GHSA-23h9-m55m-c5jp

Source

https://github.com/advisories/GHSA-23h9-m55m-c5jp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-23h9-m55m-c5jp/GHSA-23h9-m55m-c5jp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-23h9-m55m-c5jp

Aliases

CVE-2019-1003011

Published

2022-05-13T01:15:21Z

Modified

2024-02-16T08:19:10.751677Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

Details

Jenkins Token Macro Plugin recursively applied token expansion.

This could be used by users able to affect input to token expansion (such as change log messages), to inject additional tokens into the input, which would then be expanded, resulting in information disclosure (for example values of environment variables), or denial of service.

Most tokens have been changed to no longer recursively apply token expansion.

Database specific

{
    "nvd_published_at": "2019-02-06T16:29:00Z",
    "cwe_ids": [
        "CWE-674"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-10-25T23:16:02Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:token-macro

Package

Name: org.jenkins-ci.plugins:token-macro; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/token-macro

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.5.1

1.6

1.7

1.8

1.8.1

1.9

1.10

1.11

1.12

1.12.1

1.13-alpha

2.*

2.0-beta

2.0

2.1

2.2

2.3

2.4

2.5

Database specific

{
    "last_known_affected_version_range": "<= 2.5"
}