GitHub Advisoryadvisory · Maven

GHSA-3g2g-rcm6-rrq2 Cleartext Transmission of Sensitive Information in Jenkins JIRA Pipeline Steps Plugin

MEDIUM Published 2023-01-26 Modified 2023-02-06 Official page ↗
Aliases
CVE-2023-24440
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:jira-steps
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-319
Reviewed
2023-01-27

Affected packages

• Maven org.jenkins-ci.plugins:jira-steps: <= 2.0.165.v8846cf59f3db (no fix yet)

Description

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Related

Alias · CVE (1)

  • CVE-2023-24440 Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References