GitHub Advisoryadvisory · Maven

GHSA-876j-4q73-7f56 Jenkins GitHub Pull Request Builder Plugin

LOW Published 2022-05-14 Modified 2022-12-12 Official page ↗
Aliases
CVE-2018-1000143
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:ghprb
Severity
Low
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2022-12-12

Affected packages

• Maven org.jenkins-ci.plugins:ghprb: < 1.32.1 → fixed in 1.32.1

Description

GitHub Pull Request Builder Plugin stored the webhook secret shared between Jenkins and GitHub in plain text. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could result in exposure of the passwords through browser extensions, cross-site scripting vulnerabilities, and similar situations. GitHub Pull Request Builder Plugin 1.32.1 and newer stores the webhook secret encrypted on disk.

Related

Alias · CVE (1)

  • CVE-2018-1000143 An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References