Lucene search

GitHub Advisory DatabaseGHSA-R9XC-54CQ-99R7

HistoryMay 24, 2022 - 4:58 p.m.

Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin

2022-05-2416:58:50

CWE-312

GitHub Advisory Database

github.com

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

12.6%

JSON

Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Affected configurations

Vulners

Node

com.elasticbox.jenkinsci.plugins\Matchelasticbox

CPENameOperatorVersion
com.elasticbox.jenkins-ci.plugins:elasticboxle5.0.1

CPE	Name	Operator	Version
	com.elasticbox.jenkins-ci.plugins:elasticbox	le	5.0.1

References

github.com/advisories/GHSA-r9xc-54cq-99r7

jenkins.io/security/advisory/2019-10-16/#SECURITY-1434

nvd.nist.gov/vuln/detail/CVE-2019-10450

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

3.3 Low

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.0004 Low

EPSS

Percentile

12.6%

JSON

Related for GHSA-R9XC-54CQ-99R7