GHSA-c2f6-rf2r-6j6f

Source

https://github.com/advisories/GHSA-c2f6-rf2r-6j6f

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-c2f6-rf2r-6j6f/GHSA-c2f6-rf2r-6j6f.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c2f6-rf2r-6j6f

Aliases

CVE-2023-50776

Published

2023-12-13T18:31:04Z

Modified

2024-02-16T08:21:36.077521Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Summary

Tokens stored in plain text by PaaSLane Estimate Plugin

Details

Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Database specific

{
    "github_reviewed": true,
    "severity": "MODERATE",
    "nvd_published_at": "2023-12-13T18:15:44Z",
    "cwe_ids": [
        "CWE-312"
    ],
    "github_reviewed_at": "2023-12-13T19:33:53Z"
}

References

Affected packages

Maven / com.cloudtp.jenkins:paaslane-estimate

Package

Name: com.cloudtp.jenkins:paaslane-estimate; View open source insights on deps.dev
Purl: pkg:maven/com.cloudtp.jenkins/paaslane-estimate

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.0.4

Affected versions

1.*

1.0.0

1.0.3

1.0.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-c2f6-rf2r-6j6f/GHSA-c2f6-rf2r-6j6f.json"