GitHub Advisoryadvisory · Maven

GHSA-q9hm-hr89-hgm7 Jenkins WSO2 Oauth Plugin does not mask the WSO2 Oauth client secret on the global configuration form

LOW Published 2023-04-12 Modified 2023-04-12 Official page ↗
Aliases
CVE-2023-30528
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:wso2id-oauth
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2023-04-12

Affected packages

• Maven org.jenkins-ci.plugins:wso2id-oauth: <= 1.0 (no fix yet)

Description

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration. This client secret can be viewed by users with access to the Jenkins controller file system. Additionally, the global configuration form does not mask the WSO2 Oauth client secret, increasing the potential for attackers to observe and capture it.

Related

Alias · CVE (1)

  • CVE-2023-30528 Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References