GitHub Advisoryadvisory · Maven

GHSA-hx3r-qwxv-5jw9 Client Secret stored in plain text by Jenkins GitLab Authentication Plugin

LOW Published 2022-03-16 Modified 2022-11-30 Official page ↗
Aliases
CVE-2022-27206
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:gitlab-oauth
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-311, CWE-522
Reviewed
2022-11-30

Affected packages

• Maven org.jenkins-ci.plugins:gitlab-oauth: < 1.14 → fixed in 1.14

Description

Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global `config.xml` file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. This client secret can be viewed by users with access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2022-27206 Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the… vulnerability

Weakness · CWE (2)

  • CWE-311 Missing Encryption of Sensitive Data weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References