Lucene search

Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-84B9E8A965AE64B1661038FE93723397

HistoryMay 24, 2022 - 12:00 a.m.

Insufficiently Protected Credentials

2022-05-2400:00:00

https://gitlab.com/gitlab-org/security-products/gemnasium-db

gitlab.com

jenkins

bmc release

credentials

unencrypted

global configuration

users

master file system

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Affected configurations

Vulners

Node

mavenbmc-rpdRange≤1.1

VendorProductVersionCPE
mavenbmc-rpd*cpe:2.3:a:maven:bmc-rpd:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
maven	bmc-rpd	*	cpe:2.3:a:maven:bmc-rpd::::::::

References

www.openwall.com/lists/oss-security/2020/02/12/3

github.com/advisories/GHSA-2j3r-x6xc-qqqj

jenkins.io/security/advisory/2020-02-12/#SECURITY-1547

nvd.nist.gov/vuln/detail/CVE-2020-2127

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

22.0%

JSON

Related for GITLAB-84B9E8A965AE64B1661038FE93723397