Jenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere

2022-05-2416:51:51

Google

osv.dev

4.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

22.7%

JSON

Jenkins Google Kubernetes Engine Plugin 0.6.2 and earlier created a temporary file named .kube…config containing a temporary access token in the project workspace, where it could be accessed by users with Job/Read permission.

This temporary file is now created outside the regular project workspace.

CPENameOperatorVersion
org.jenkins-ci.plugins:google-kubernetes-engineeq0.2.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.5.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.6.2
org.jenkins-ci.plugins:google-kubernetes-engineeq0.6.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.4.0
org.jenkins-ci.plugins:google-kubernetes-engineeq0.6.1

Name	Operator	Version
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.2.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.5.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.6.2
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.6.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.4.0
org.jenkins-ci.plugins:google-kubernetes-engine	eq	0.6.1