GoogleOSV:GHSA-86J9-25M2-9W97Non-constant time webhook token hash comparison in Jenkins Zanata Plugin
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.8 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.1%
Jenkins Zanata Plugin 0.6 and earlier does not use a constant-time comparison when checking whether the provided and expected webhook token hashes are equal.
This could potentially allow attackers to use statistical methods to obtain a valid webhook token.
As of publication of this advisory, there is no fix.
| CPE | Name | Operator | Version |
|---|---|---|---|
| org.jenkins-ci.plugins:zanata | eq | 0.3 | |
| org.jenkins-ci.plugins:zanata | eq | 0.5 | |
| org.jenkins-ci.plugins:zanata | eq | 0.6 |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
6.8 Medium
AI Score
Confidence
High
0.0005 Low
EPSS
Percentile
17.1%