GitHub Advisoryadvisory · Maven

GHSA-hpv3-f5p7-pxj9 Jenkins lambdatest-automation Plugin may expose Credentials access token

LOW Published 2023-10-25 Modified 2023-11-02 Official page ↗
Aliases
CVE-2023-46653
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:lambdatest-automation
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2023-11-02

Affected packages

• Maven org.jenkins-ci.plugins:lambdatest-automation: < 1.21.0 → fixed in 1.21.0

Description

Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level. This can result in accidental exposure of the token through the default system log. lambdatest-automation Plugin 1.21.0 no longer logs LAMBDATEST Credentials access token.

Related

Alias · CVE (1)

  • CVE-2023-46653 Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References