CVE-2023-46653

2023-10-2518:17:40

CWE-312

[email protected]

web.nvd.nist.gov

cve

jenkins

lambdatest-automation plugin

security

access token

exposure

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.0005 Low

EPSS

Percentile

18.3%

JSON

Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting in its exposure.

Affected configurations

NVD

Node

jenkinslambdatest-automationRange<1.21.0jenkins

CPENameOperatorVersion
jenkins:lambdatest-automationjenkins lambdatest-automationlt1.21.0

CPE	Name	Operator	Version
jenkins:lambdatest-automation	jenkins lambdatest-automation	lt	1.21.0

CNA Affected

[
  {
    "vendor": "Jenkins Project",
    "product": "Jenkins lambdatest-automation Plugin",
    "versions": [
      {
        "version": "0",
        "versionType": "maven",
        "lessThanOrEqual": "1.20.10",
        "status": "affected"
      }
    ],
    "defaultStatus": "unaffected"
  }
]