GitHub Advisoryadvisory · Maven

GHSA-4x65-4fjx-r7m6 Plaintext storage of Access Token in Jenkins GitHub Pull Request Coverage Status Plugin

MEDIUM Published 2023-01-26 Modified 2023-02-03 Official page ↗
Aliases
CVE-2023-24442
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:github-pr-coverage-status
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-256, CWE-312
Reviewed
2023-01-27

Affected packages

• Maven org.jenkins-ci.plugins:github-pr-coverage-status: <= 2.2.0 (no fix yet)

Description

Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2023-24442 Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References