Lucene search

GitHub Advisory DatabaseGHSA-H6PP-V4J6-W76C

HistoryMay 24, 2022 - 5:08 p.m.

Password stored in plain text by Dynamic Extended Choice Parameter Plugin

2022-05-2417:08:47

CWE-256

CWE-522

GitHub Advisory Database

github.com

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

22.0%

JSON

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

Affected configurations

Vulners

Node

jenkinsextended_choice_parameterRange≤1.0.1jenkins

CPENameOperatorVersion
com.moded.extendedchoiceparameter:dynamic_extended_choice_parameterle1.0.1

CPE	Name	Operator	Version
	com.moded.extendedchoiceparameter:dynamic_extended_choice_parameter	le	1.0.1

References

www.openwall.com/lists/oss-security/2020/02/12/3

github.com/advisories/GHSA-h6pp-v4j6-w76c

jenkins.io/security/advisory/2020-02-12/#SECURITY-1560

nvd.nist.gov/vuln/detail/CVE-2020-2124

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

22.0%

JSON

Related for GHSA-H6PP-V4J6-W76C