CVE-2018-1000196

Published: Jun 5, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured Gitlab token.

Affected (1)

Products: Jenkins: Gitlab Hook

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Gitlab Hook	Up to 1.4.2

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://jenkins.io/security/advisory/2018-05-09/#SECURITY-263

Source: cve@mitre.org

Vendor Advisory

https://jenkins.io/security/advisory/2018-05-09/#SECURITY-263

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.