CVE-2018-1999036

Published: Aug 1, 2018Modified: Nov 21, 2024

6.5

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log.

Affected (1)

Products: Jenkins: Ssh Agent

Jenkins

1 product

Ssh Agent

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Ssh Agent	Up to 1.15

Related CWEs

CWE-532

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (2)

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-704

Source: cve@mitre.org

Vendor Advisory

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-704

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.