GitHub Advisoryadvisory · Maven

GHSA-cpm5-cqr9-7p79 Jenkins BigPanda Notifier Plugin Missing Password Field Masking

LOW Published 2022-09-22 Modified 2022-12-09 Official page ↗
Aliases
CVE-2022-41248
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:bigpanda-jenkins
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312, CWE-549
Reviewed
2022-09-23

Affected packages

• Maven org.jenkins-ci.plugins:bigpanda-jenkins: <= 1.4.0 (no fix yet)

Description

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file `BigpandaGlobalNotifier.xml` on the Jenkins controller as part of its configuration. This API key can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

Related

Alias · CVE (1)

  • CVE-2022-41248 Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the… vulnerability

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-549 Missing Password Field Masking weakness

References