Lucene search

GitHub Advisory DatabaseGHSA-V3R8-6VFJ-PPPF

HistoryJul 01, 2022 - 12:01 a.m.

Plaintext Storage of a Password in Jenkins Build Notifications Plugin

2022-07-0100:01:07

CWE-256

CWE-522

GitHub Advisory Database

github.com

plaintext storage

password

jenkins build notifications plugin

global configuration

unencrypted

pushover application token

slack bot token

telegram bot token

configuration files

security issue

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Build Notifications Plugin 1.5.0 and earlier stores multiple tokens unencrypted in its global configuration files on the Jenkins controller as part of its configuration:- Pushover Application Token in tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml\n- Slack Bot Token in tools.devnull.jenkins.plugins.buildnotifications.SlackNotifier.xml\n- Telegram Bot Token in tools.devnull.jenkins.plugins.buildnotifications.TelegramNotifier.xml

Affected configurations

Vulners

Node

tools.devnullbuild-notificationsRange≤1.5.0

VendorProductVersionCPE
tools.devnullbuild-notifications*cpe:2.3:a:tools.devnull:build-notifications:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
tools.devnull	build-notifications	*	cpe:2.3:a:tools.devnull:build-notifications::::::::

References

github.com/advisories/GHSA-v3r8-6vfj-pppf

nvd.nist.gov/vuln/detail/CVE-2022-34800

www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2056

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Related for GHSA-V3R8-6VFJ-PPPF