GHSA-56hc-wf49-2h96

Source

https://github.com/advisories/GHSA-56hc-wf49-2h96

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/07/GHSA-56hc-wf49-2h96/GHSA-56hc-wf49-2h96.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-56hc-wf49-2h96

Aliases

CVE-2022-34799

Published

2022-07-01T00:01:07Z

Modified

2024-02-16T08:10:58.142421Z

Severity

3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Plaintext Storage of a Password in Jenkins Deployment Dashboard Plugin

Details

Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file de.codecentric.jenkins.dashboard.DashboardView.xml on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file system.

Database specific

{
    "nvd_published_at": "2022-06-30T18:15:00Z",
    "cwe_ids": [
        "CWE-256",
        "CWE-522"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-11T20:58:44Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:ec2-deployment-dashboard

Package

Name: org.jenkins-ci.plugins:ec2-deployment-dashboard; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/ec2-deployment-dashboard

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.10

Affected versions

1.*

1.0.2

1.0.3

1.0.4

1.0.7

1.0.8

1.0.10