Lucene search

GitHub Advisory DatabaseGHSA-J7XV-FC46-HGPG

HistorySep 22, 2022 - 12:00 a.m.

Jenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted

2022-09-2200:00:29

CWE-256

CWE-522

GitHub Advisory Database

github.com

jenkins

bigpanda

notifier plugin

unencrypted

api key

configuration

global

file

security

vulnerability

jenkins controller

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration. This API key can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

Affected configurations

Vulners

Node

org.jenkins-ci.pluginsbigpanda-jenkinsRange≤1.4.0

VendorProductVersionCPE
org.jenkins-ci.pluginsbigpanda-jenkins*cpe:2.3:a:org.jenkins-ci.plugins:bigpanda-jenkins:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.jenkins-ci.plugins	bigpanda-jenkins	*	cpe:2.3:a:org.jenkins-ci.plugins:bigpanda-jenkins::::::::

References

github.com/advisories/GHSA-j7xv-fc46-hgpg

nvd.nist.gov/vuln/detail/CVE-2022-41247

www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2243

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Related for GHSA-J7XV-FC46-HGPG