Lucene search

GoogleOSV:GHSA-56HC-WF49-2H96

HistoryJul 01, 2022 - 12:01 a.m.

Plaintext Storage of a Password in Jenkins Deployment Dashboard Plugin

2022-07-0100:01:07

Google

osv.dev

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

22.0%

JSON

Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file de.codecentric.jenkins.dashboard.DashboardView.xml on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file system.

CPENameOperatorVersion
org.jenkins-ci.plugins:ec2-deployment-dashboardeq1.0.7
org.jenkins-ci.plugins:ec2-deployment-dashboardeq1.0.8
org.jenkins-ci.plugins:ec2-deployment-dashboardeq1.0.4
org.jenkins-ci.plugins:ec2-deployment-dashboardeq1.0.10
org.jenkins-ci.plugins:ec2-deployment-dashboardeq1.0.3
org.jenkins-ci.plugins:ec2-deployment-dashboardeq1.0.2

Name	Operator	Version
org.jenkins-ci.plugins:ec2-deployment-dashboard	eq	1.0.7
org.jenkins-ci.plugins:ec2-deployment-dashboard	eq	1.0.8
org.jenkins-ci.plugins:ec2-deployment-dashboard	eq	1.0.4
org.jenkins-ci.plugins:ec2-deployment-dashboard	eq	1.0.10
org.jenkins-ci.plugins:ec2-deployment-dashboard	eq	1.0.3
org.jenkins-ci.plugins:ec2-deployment-dashboard	eq	1.0.2

References

github.com/jenkinsci/ec2-deployment-dashboard

nvd.nist.gov/vuln/detail/CVE-2022-34799

www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2070

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

22.0%

JSON

Related for OSV:GHSA-56HC-WF49-2H96