GitHub Advisoryadvisory · Maven

GHSA-j55j-28wc-v338 Jenkins Report Portal Plugin configuration form does not mask tokens

MEDIUM Published 2023-04-12 Modified 2023-04-21 Official page ↗
Aliases
CVE-2023-30524
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:reportportal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Reviewed
2023-04-12

Affected packages

• Maven org.jenkins-ci.plugins:reportportal: <= 0.5 (no fix yet)

Description

Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.

Related

Alias · CVE (1)

  • CVE-2023-30524 Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the… vulnerability

References