CVE-2018-1999041

Published: Aug 1, 2018Modified: Nov 21, 2024

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.

Affected (1)

Products: Jenkins: Tinfoil Security

1 product

Tinfoil Security

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Tinfoil Security	Up to 1.6.1

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-840

Source: cve@mitre.org

Vendor Advisory

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-840

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.