GitHub Advisoryadvisory · Maven

GHSA-jp8r-jh5j-cgwf Jenkins CodeScan Plugin has Insufficiently Protected Credentials

LOW Published 2022-05-24 Modified 2023-02-23 Official page ↗
Aliases
CVE-2019-10423
Ecosystem
Maven
Packages
com.villagechief.codescan.jenkins:codescan
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2023-02-23

Affected packages

• Maven com.villagechief.codescan.jenkins:codescan: <= 1.0 (no fix yet)

Description

CodeScan Plugin stores an API key unencrypted in its global configuration file `com.villagechief.codescan.jenkins.CodeScanBuilder.xml` on the Jenkins controller. This API key can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2019-10423 Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References