GitHub Advisoryadvisory · Maven

GHSA-c2f6-rf2r-6j6f Tokens stored in plain text by PaaSLane Estimate Plugin

MEDIUM Published 2023-12-13 Modified 2023-12-18 Official page ↗
Aliases
CVE-2023-50776
Ecosystem
Maven
Packages
com.cloudtp.jenkins:paaslane-estimate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2023-12-13

Affected packages

• Maven com.cloudtp.jenkins:paaslane-estimate: <= 1.0.4 (no fix yet)

Description

Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2023-50776 Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References