Lucene search

GitHub Advisory DatabaseGHSA-Q2WV-M3PQ-XPV9

HistoryMay 24, 2022 - 5:10 p.m.

Credentials transmitted in plain text by Skytap Cloud CI Plugin

2022-05-2417:10:30

CWE-319

GitHub Advisory Database

github.com

credentials

plain text

encryption

configuration

security vulnerability

skytap cloud ci plugin

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Skytap Cloud CI Plugin stores credentials in job config.xml files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin 2.07 and earlier. These credentials could be viewed by users with Extended Read permission.

Affected configurations

Vulners

Node

org.jenkinsci.plugins\Matchskytap

References

www.openwall.com/lists/oss-security/2020/03/09/1

github.com/advisories/GHSA-q2wv-m3pq-xpv9

jenkins.io/security/advisory/2020-03-09/#SECURITY-1522

nvd.nist.gov/vuln/detail/CVE-2020-2157

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Related for GHSA-Q2WV-M3PQ-XPV9