GHSA-pv2g-vm98-vjxf
Suggest an improvement- Source
- https://github.com/advisories/GHSA-pv2g-vm98-vjxf
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/08/GHSA-pv2g-vm98-vjxf/GHSA-pv2g-vm98-vjxf.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-pv2g-vm98-vjxf
- Aliases
- Published
- 2023-08-16T15:30:18Z
- Modified
- 2024-02-16T08:24:10.564570Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Jenkins Config File Provider Plugin improper credential masking vulnerability
- Details
-
Jenkins Config File Provider Plugin 952.va544a6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in configuration files when they’re written to the build log.
Config File Provider Plugin 953.v0432a_802e4d2 masks credentials configured in configuration files if they appear in the build log.
- References
Affected packages
Maven / org.jenkins-ci.plugins:config-file-provider
Package
- Name
- org.jenkins-ci.plugins:config-file-provider
- View open source insights on deps.dev
- Purl
- pkg:maven/org.jenkins-ci.plugins/config-file-provider
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed953.v0432a
Affected versions
1.*
1.0
1.1
1.2
1.5
1.6.1
1.9.1
2.*
2.0
2.1
2.1.1
2.2.1
2.3
2.4
2.5
2.5.1
2.6
2.6.1
2.6.2
2.7
2.7.1
2.7.4
2.7.5
2.8.1
2.9.2
2.9.3
2.10.0
2.10.1
2.11
2.13
2.14-beta
2.14.1-beta
2.14.2-beta
2.15
2.15.1
2.15.2-beta
2.15.3-beta
2.15.3
2.15.4
2.15.5
2.15.6
2.15.7
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.17
2.18
3.*
3.0
3.1
3.2
3.3
3.4
3.4.1
3.5
3.6
3.6.2
3.6.3
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.9.0
3.10.0
3.11
3.11.1
938.*
938.ve2b_8a_591c596
951.*
951.v0461b_87b_721b_
951.953.vdfc5f6e2dcc4
952.*
952.va_544a_6234b_46