GHSA-4wx5-c723-xvwv

Source

https://github.com/advisories/GHSA-4wx5-c723-xvwv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-4wx5-c723-xvwv/GHSA-4wx5-c723-xvwv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4wx5-c723-xvwv

Aliases

CVE-2020-2177

Published

2022-05-24T17:15:35Z

Modified

2024-02-16T08:14:44.175145Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Credentials stored in plain text by Jenkins Copr Plugin

Details

Copr Plugin 0.3 and earlier stores credentials unencrypted in job config.xml files as part of its configuration. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

Copr Plugin 0.6.1 stores these credentials encrypted. This change is effective once the job configuration is saved the next time.

Database specific

{
    "nvd_published_at": "2020-04-16T19:15:00Z",
    "cwe_ids": [
        "CWE-256",
        "CWE-312"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-12-16T23:00:33Z"
}

References

Affected packages

Maven / org.fedoraproject.jenkins.plugins:copr

Package

Name: org.fedoraproject.jenkins.plugins:copr; View open source insights on deps.dev
Purl: pkg:maven/org.fedoraproject.jenkins.plugins/copr

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

0.6.1

Affected versions

0.*

0.1

0.2

0.3

Database specific

{
    "last_known_affected_version_range": "<= 0.3"
}