GitHub Advisoryadvisory · Maven

GHSA-3hw6-gc8h-9243 Jenkins meliora-testlab Plugin allows attackers with file system access to Jenkins master to obtain API key

LOW Published 2022-05-14 Modified 2022-12-12 Official page ↗
Aliases
CVE-2018-1999031
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:meliora-testlab
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-12-12

Affected packages

• Maven org.jenkins-ci.plugins:meliora-testlab: < 1.15 → fixed in 1.15

Description

An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuration. Additionally, the API key was not masked from view using a password form field. As of version 1.15, the plugin stores the API Key encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text.

Related

Alias · CVE (1)

  • CVE-2018-1999031 An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References