GitHub Advisoryadvisory · Maven

GHSA-mf4p-wjrm-cmjp AWS secrets displayed without masking by Jenkins S3 Explorer Plugin

LOW Published 2022-10-19 Modified 2022-12-16 Official page ↗
Aliases
CVE-2022-43426
Ecosystem
Maven
Packages
io.jenkins.plugins:s3explorer
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-256, CWE-549
Reviewed
2022-10-19

Affected packages

• Maven io.jenkins.plugins:s3explorer: <= 1.0.8 (no fix yet)

Description

S3 Explorer Plugin stores AWS_SECRET_ACCESS_KEY in its global configuration file `s3explorer.xml` on the Jenkins controller as part of its configuration. While this secret is stored encrypted on disk, in S3 Explorer Plugin 1.0.8 and earlier the global configuration form does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to observe and capture it.

Related

Alias · CVE (1)

  • CVE-2022-43426 Jenkins S3 Explorer Plugin 1.0.8 and earlier does not mask the AWS_SECRET_ACCESS_KEY form field, increasing the potential for attackers to… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-549 Missing Password Field Masking weakness

References