Lucene search

GitHub Advisory DatabaseGHSA-65RJ-CGRP-G65W

HistoryMay 24, 2022 - 4:55 p.m.

Jenkins IBM AppScan Plugin showed plain text password in job configuration form fields

2022-05-2416:55:01

CWE-319

GitHub Advisory Database

github.com

jenkins

ibm

appscan

plugin

plaintext

password

exposure

job configuration

deprecated

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure. This plugin has bee deprecated.

Affected configurations

Vulners

Node

com.hcl.securityibm-application-securityRange≤1.2.4

VendorProductVersionCPE
com.hcl.securityibm-application-security*cpe:2.3:a:com.hcl.security:ibm-application-security:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
com.hcl.security	ibm-application-security	*	cpe:2.3:a:com.hcl.security:ibm-application-security::::::::

References

www.openwall.com/lists/oss-security/2019/08/28/4

github.com/advisories/GHSA-65rj-cgrp-g65w

jenkins.io/security/advisory/2019-08-28/#SECURITY-1512

nvd.nist.gov/vuln/detail/CVE-2019-10391

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

Related for GHSA-65RJ-CGRP-G65W