GitHub Advisoryadvisory · Maven

GHSA-68qx-whxm-h4c4 Exposure of sensitive information vulnerability

MEDIUM Published 2022-05-14 Modified 2022-11-01 Official page ↗
Aliases
CVE-2018-1999041
Ecosystem
Maven
Packages
com.tinfoilsecurity.plugins:tinfoil-scan
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-11-01

Affected packages

• Maven com.tinfoilsecurity.plugins:tinfoil-scan: < 2.0 → fixed in 2.0

Description

An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.

Related

Alias · CVE (1)

  • CVE-2018-1999041 An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References