CVE-2018-1999027

2018-08-0113:29:00

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

32.3%

JSON

An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.

CPENameOperatorVersion
saltstack-plugineq1.7.0-beta
saltstack-plugineq1.5.99-beta
saltstack-plugineqsaltstack-3.1.2-beta1
saltstack-plugineqsaltstack-2.0.1
saltstack-plugineqsaltstack-1.1.5
saltstack-plugineqsaltstack-1.5.0
saltstack-plugineqsaltstack-3.1.2
saltstack-plugineq1.1.2
saltstack-plugineqsaltstack-3.1.6
saltstack-plugineq1.7.0-beta3

Name	Operator	Version
saltstack-plugin	eq	1.7.0-beta
saltstack-plugin	eq	1.5.99-beta
saltstack-plugin	eq	saltstack-3.1.2-beta1
saltstack-plugin	eq	saltstack-2.0.1
saltstack-plugin	eq	saltstack-1.1.5
saltstack-plugin	eq	saltstack-1.5.0
saltstack-plugin	eq	saltstack-3.1.2
saltstack-plugin	eq	1.1.2
saltstack-plugin	eq	saltstack-3.1.6
saltstack-plugin	eq	1.7.0-beta3