GHSA-cwcf-5m5w-mq2w

Source

https://github.com/advisories/GHSA-cwcf-5m5w-mq2w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cwcf-5m5w-mq2w/GHSA-cwcf-5m5w-mq2w.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cwcf-5m5w-mq2w

Aliases

CVE-2018-1000601

Published

2022-05-14T03:07:03Z

Modified

2024-02-16T08:05:34.897390Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin

Details

A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.

Database specific

{
    "nvd_published_at": "2018-06-26T17:29:00Z",
    "github_reviewed_at": "2022-06-30T16:23:28Z",
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-200"
    ],
    "github_reviewed": true
}

References

Affected packages

Maven / org.jenkins-ci.plugins:ssh-credentials

Package

Name: org.jenkins-ci.plugins:ssh-credentials; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/ssh-credentials

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.14

Affected versions

0.*

0.1

0.2

0.3

0.4

1.*

1.0

1.1

1.2

1.3

1.4

1.5

1.5.1

1.6

1.6.1

1.7

1.7.1

1.8

1.9

1.10

1.11

1.12

1.13

Database specific

last_known_affected_version_range

"<= 1.13"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cwcf-5m5w-mq2w/GHSA-cwcf-5m5w-mq2w.json"

Maven / org.jenkins-ci.plugins:credentials

Package

Name: org.jenkins-ci.plugins:credentials; View open source insights on deps.dev
Purl: pkg:maven/org.jenkins-ci.plugins/credentials

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.1.17

Affected versions

1.*

1.0

1.1

1.2

1.3

1.3.1

1.4

1.5

1.6

1.7

1.7.1

1.7.2

1.7.3

1.7.4

1.7.5

1.7.6

1.8

1.8.1

1.8.2

1.8.3

1.8.4

1.9

1.9.1

1.9.2

1.9.3

1.9.4

1.10

1.11

1.12

1.13

1.14

1.15

1.16

1.16.1

1.17

1.18

1.19

1.20

1.21

1.22

1.23

1.24

1.25

1.26

1.27

1.28

2.*

2.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-cwcf-5m5w-mq2w/GHSA-cwcf-5m5w-mq2w.json"