GHSA-c4fr-gx5w-8qf2

Source

https://github.com/advisories/GHSA-c4fr-gx5w-8qf2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c4fr-gx5w-8qf2/GHSA-c4fr-gx5w-8qf2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c4fr-gx5w-8qf2

Aliases

CVE-2013-6372

Published

2022-05-17T04:44:32Z

Modified

2025-03-13T19:28:45Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Jenkins Subversion Plugin Stores Credentials with Base64 Encoding

Details

The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.

Database specific

{
    "cwe_ids":  [
        "CWE-326"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-03-13T19:18:24Z",
    "nvd_published_at":  "2014-05-08T14:29:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.jenkins-ci.plugins:subversion

Package

Name: org.jenkins-ci.plugins:subversion; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/subversion

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.54

Affected versions

1.*

1.24

1.25

1.26

1.28

1.29

1.30

1.31

1.32

1.33

1.34

1.35

1.36

1.37

1.38

1.39

1.40

1.41

1.42

1.43

1.44

1.45

1.48

1.50

1.51

1.53

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c4fr-gx5w-8qf2/GHSA-c4fr-gx5w-8qf2.json"