GitHub Advisoryadvisory · Maven

GHSA-v9w3-34xq-hrjg Tokens stored in plain text by PaaSLane Estimate Plugin

MEDIUM Published 2023-12-13 Modified 2023-12-18 Official page ↗
Aliases
CVE-2023-50777
Ecosystem
Maven
Packages
com.cloudtp.jenkins:paaslane-estimate
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312, CWE-863
Reviewed
2023-12-13

Affected packages

• Maven com.cloudtp.jenkins:paaslane-estimate: <= 1.0.4 (no fix yet)

Description

Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Related

Alias · CVE (1)

  • CVE-2023-50777 Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form,… vulnerability

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-863 Incorrect Authorization weakness

References