Lucene search

GitHub Advisory DatabaseGHSA-HMF2-PRM5-RVXM

HistoryMay 13, 2022 - 1:15 a.m.

Jenkins mabl Plugin stores credentials in plain text

2022-05-1301:15:05

CWE-522

GitHub Advisory Database

github.com

jenkins

mabl plugin

credentials

unencrypted

config files

security

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

65.1%

JSON

Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Affected configurations

Vulners

Node

com.mabl.integration.jenkins\mablMatchintegration

References

www.openwall.com/lists/oss-security/2019/04/12/2

github.com/advisories/GHSA-hmf2-prm5-rvxm

jenkins.io/security/advisory/2019-04-03/#SECURITY-946

nvd.nist.gov/vuln/detail/CVE-2019-10283

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

65.1%

JSON

Related for GHSA-HMF2-PRM5-RVXM