CVE-2018-1000610

Published: Jun 26, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.

Affected (7)

Products: Jenkins: Configuration As Code

Jenkins

1 product

Configuration As Code

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Jenkins Configuration As Code	Version 0.1 alpha
Jenkins Configuration As Code	Version 0.2 alpha
Jenkins Configuration As Code	Version 0.3 alpha
Jenkins Configuration As Code	Version 0.4 alpha
Jenkins Configuration As Code	Version 0.5 alpha
Jenkins Configuration As Code	Version 0.6 alpha
Jenkins Configuration As Code	Version 0.7 alpha

Related CWEs

CWE-522

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (2)

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-929

Source: cve@mitre.org

Vendor Advisory

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-929

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.