GitHub Advisoryadvisory · Maven

GHSA-gqxr-hvrw-6hfh Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking

LOW Published 2023-05-16 Modified 2023-05-17 Official page ↗
Aliases
CVE-2023-33000
Ecosystem
Maven
Packages
io.jenkins.plugins:cavisson-ns-nd-integration
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2023-05-17

Affected packages

• Maven io.jenkins.plugins:cavisson-ns-nd-integration: < 4.11.0.48 → fixed in 4.11.0.48

Description

Jenkins NS-ND Integration Performance Publisher Plugin stores credentials in job config.xml files on the Jenkins controller as part of its configuration. While these credentials are stored encrypted on disk, in NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them. NS-ND Integration Performance Publisher Plugin 4.11.0.48 masks credentials displayed on the configuration form.

Related

Alias · CVE (1)

  • CVE-2023-33000 Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier does not mask credentials displayed on the configuration form,… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References