GitHub Advisoryadvisory · Maven

GHSA-qgw9-vgrf-h723 Jenkins Report Portal Plugin allows users with Item/Extended Read permission to view tokens on Jenkins controller

MEDIUM Published 2023-04-12 Modified 2023-04-12 Official page ↗
Aliases
CVE-2023-30523
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:reportportal
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312
Reviewed
2023-04-12

Affected packages

• Maven org.jenkins-ci.plugins:reportportal: <= 0.5 (no fix yet)

Description

Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration. These tokens can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the configuration form does not mask these tokens, increasing the potential for attackers to observe and capture them.

Related

Alias · CVE (1)

  • CVE-2023-30523 Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References