Lucene search

GitHub Advisory DatabaseGHSA-8FM4-R23P-V68V

HistoryMar 06, 2024 - 6:30 p.m.

Jenkins MQ Notifier Plugin exposes sensitive information in build logs

2024-03-0618:30:38

GitHub Advisory Database

github.com

jenkins

notifier

plugin

sensitive information

build logs

debug information

6.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by default.

Affected configurations

Vulners

Node

com.sonymobile.jenkins.plugins.mq\mqMatchnotifier

CPENameOperatorVersion
com.sonymobile.jenkins.plugins.mq:mq-notifierlt1.4.1

CPE	Name	Operator	Version
	com.sonymobile.jenkins.plugins.mq:mq-notifier	lt	1.4.1

www.openwall.com/lists/oss-security/2024/03/06/3

github.com/advisories/GHSA-8fm4-r23p-v68v

github.com/jenkinsci/mq-notifier-plugin/commit/46c9f228a3317eb87562bc3d99f7e184bdcecbfe

nvd.nist.gov/vuln/detail/CVE-2024-28154

www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3180