Lucene search

GoogleOSV:GHSA-HPV3-F5P7-PXJ9

HistoryOct 25, 2023 - 6:32 p.m.

Jenkins lambdatest-automation Plugin may expose Credentials access token

2023-10-2518:32:25

Google

osv.dev

jenkins

lambdatest-automation

plugin

credentials

access token

1.20.10

accidental exposure

system log

1.21.0

software

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level.

This can result in accidental exposure of the token through the default system log.

lambdatest-automation Plugin 1.21.0 no longer logs LAMBDATEST Credentials access token.

CPENameOperatorVersion
org.jenkins-ci.plugins:lambdatest-automationeq1.20.10
org.jenkins-ci.plugins:lambdatest-automationeq1.20.0
org.jenkins-ci.plugins:lambdatest-automationeq1.6
org.jenkins-ci.plugins:lambdatest-automationeq1.14.4
org.jenkins-ci.plugins:lambdatest-automationeq1.10
org.jenkins-ci.plugins:lambdatest-automationeq1.20.4
org.jenkins-ci.plugins:lambdatest-automationeq1.8
org.jenkins-ci.plugins:lambdatest-automationeq1.20.5
org.jenkins-ci.plugins:lambdatest-automationeq1.20.7
org.jenkins-ci.plugins:lambdatest-automationeq1.9

Name	Operator	Version
org.jenkins-ci.plugins:lambdatest-automation	eq	1.20.10
org.jenkins-ci.plugins:lambdatest-automation	eq	1.20.0
org.jenkins-ci.plugins:lambdatest-automation	eq	1.6
org.jenkins-ci.plugins:lambdatest-automation	eq	1.14.4
org.jenkins-ci.plugins:lambdatest-automation	eq	1.10
org.jenkins-ci.plugins:lambdatest-automation	eq	1.20.4
org.jenkins-ci.plugins:lambdatest-automation	eq	1.8
org.jenkins-ci.plugins:lambdatest-automation	eq	1.20.5
org.jenkins-ci.plugins:lambdatest-automation	eq	1.20.7
org.jenkins-ci.plugins:lambdatest-automation	eq	1.9

Rows per page:

1-10 of 221

References

www.openwall.com/lists/oss-security/2023/10/25/2

nvd.nist.gov/vuln/detail/CVE-2023-46653

www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3202

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Related for OSV:GHSA-HPV3-F5P7-PXJ9