GitHub Advisoryadvisory · Maven

GHSA-h8c5-c92g-jq6x Improper Input Validation in Jenkins

LOW Published 2022-05-14 Modified 2022-07-01 Official page ↗
Aliases
CVE-2017-1000401
Ecosystem
Maven
Packages
org.jenkins-ci.main:jenkins-core
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-20
Reviewed
2022-07-01

Affected packages

• Maven org.jenkins-ci.main:jenkins-core: < 2.73.2 → fixed in 2.73.2 • Maven org.jenkins-ci.main:jenkins-core: >= 2.74, < 2.84 → fixed in 2.84

Description

The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, , supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for is now always sent via POST, which is typically not logged.

Related

Alias · CVE (1)

  • CVE-2017-1000401 The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References