GitHub Advisoryadvisory · Maven

GHSA-gp67-c7j2-2qg2 Insertion of Sensitive Information into Log File in Jenkins Mask Passwords Plugin

MEDIUM Published 2022-05-24 Modified 2022-06-28 Official page ↗
Aliases
CVE-2019-10370
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:mask-passwords
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-319, CWE-532
Reviewed
2022-06-28

Affected packages

• Maven org.jenkins-ci.plugins:mask-passwords: < 2.13.0 → fixed in 2.13.0

Description

Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure.

Related

Alias · CVE (1)

  • CVE-2019-10370 Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form,… vulnerability

Weakness · CWE (2)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References