GitHub Advisoryadvisory · Maven

GHSA-j7xv-fc46-hgpg Jenkins BigPanda Notifier Plugin stores BigPanda API key unencrypted

LOW Published 2022-09-22 Modified 2022-12-09 Official page ↗
Aliases
CVE-2022-41247
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:bigpanda-jenkins
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-256, CWE-522
Reviewed
2022-09-23

Affected packages

• Maven org.jenkins-ci.plugins:bigpanda-jenkins: <= 1.4.0 (no fix yet)

Description

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file `BigpandaGlobalNotifier.xml` on the Jenkins controller as part of its configuration. This API key can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

Related

Alias · CVE (1)

  • CVE-2022-41247 Jenkins BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file on the Jenkins… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References