GitHub Advisoryadvisory · Maven

GHSA-g472-f8cm-8x5f Jenkins WSO2 Oauth Plugin stores WSO2 Oauth client secret unencrypted in global config.xml file on Jenkins controller

LOW Published 2023-04-12 Modified 2023-04-12 Official page ↗
Aliases
CVE-2023-30527
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:wso2id-oauth
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2023-04-12

Affected packages

• Maven org.jenkins-ci.plugins:wso2id-oauth: <= 1.0 (no fix yet)

Description

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration. This client secret can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the WSO2 Oauth client secret, increasing the potential for attackers to observe and capture it.

Related

Alias · CVE (1)

  • CVE-2023-30527 Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References