GHSA-8hwr-589g-xpj2

Source

https://github.com/advisories/GHSA-8hwr-589g-xpj2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-8hwr-589g-xpj2/GHSA-8hwr-589g-xpj2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8hwr-589g-xpj2

Aliases

CVE-2019-10415

Published

2022-05-24T16:56:46Z

Modified

2024-02-16T08:19:22.595932Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Jenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials

Details

Violation Comments to GitLab Plugin stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Violation Comments to GitLab Plugin now stores these credentials encrypted. Existing jobs need to have their configuration saved for existing plain text credentials to be overwritten.

Database specific

{
    "nvd_published_at": "2019-09-25T16:15:00Z",
    "cwe_ids": [
        "CWE-522"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-23T20:32:28Z"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:violation-comments-to-gitlab

Package

Name: org.jenkins-ci.plugins:violation-comments-to-gitlab; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/violation-comments-to-gitlab

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.29

Affected versions

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

1.9

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.17

1.18

1.19

1.21

1.22

1.23

1.24

1.25

1.26

1.27

1.28

2.*

2.0

2.1

2.2

2.3

2.4

2.5

2.6

2.8

2.9

2.10

2.11

2.13

2.14

2.15

2.16

2.17

2.18

2.19

2.20

2.21

2.22

2.23

2.24

2.25

2.26

2.27

2.28