GitHub Advisoryadvisory · Maven
GHSA-fcxw-hhxq-48wx Insecure temporary file usage in Jenkins Git Client Plugin
LOW
Official page ↗
- Aliases
- CVE-2017-1000242
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:git-client
- Severity
- Low
- CVSS vector
- CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-200
- Reviewed
- 2022-06-02
Affected packages
• Maven org.jenkins-ci.plugins:git-client: < 2.4.3 → fixed in 2.4.3
Description
Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure
Related
Alias · CVE (1)
- CVE-2017-1000242 Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure vulnerability
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000242 advisory
- https://github.com/jenkinsci/git-client-plugin/commit/75ea3fe05650fc6ca09046a72493e2b3f066fb98 web
- https://github.com/jenkinsci/git-client-plugin package
- https://jenkins.io/security/advisory/2017-04-27 web
- http://www.securityfocus.com/bid/101940 web