CVE-2023-24442

Published: Jan 26, 2023Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Affected (1)

Products: Jenkins: Github Pull Request Coverage Status

1 product

Github Pull Request Coverage Status

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Jenkins Github Pull Request Coverage Status	Up to 2.2.0

Related CWEs

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References (2)

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2767

Source: jenkinsci-cert@googlegroups.com

Vendor Advisory

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2767

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.