GitHub Advisoryadvisory · Maven

GHSA-fjh2-qhfh-rvfc Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin CSRF vulnerability and missing permission checks

MEDIUM Published 2022-05-13 Modified 2024-01-09 Official page ↗
Aliases
CVE-2018-1999030
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:maven-artifact-choicelistprovider
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-200
Reviewed
2024-01-09

Affected packages

• Maven org.jenkins-ci.plugins:maven-artifact-choicelistprovider: < 1.3.2 → fixed in 1.3.2

Description

An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, Nexus3ChoiceListProvider.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.

Related

Alias · CVE (1)

  • CVE-2018-1999030 An exposure of sensitive information vulnerability exists in Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.3.1 and earlier in… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References