Design/Logic Flaw

2020-09-0114:15:00

PRIOn knowledge base

www.prio-n.com

3.9 Low

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

12.8%

JSON

Jenkins Team Foundation Server Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.

CPENameOperatorVersion
team_foundation_serverle5.157.1

CPE	Name	Operator	Version
	team_foundation_server	le	5.157.1

References

www.openwall.com/lists/oss-security/2020/09/01/3

jenkins.io/security/advisory/2020-09-01/