GitHub Advisoryadvisory · Maven

GHSA-x3qh-53qf-jxq9 Jenkins Gitea Plugin vulnerable to Cleartext Transmission of Sensitive Information

MEDIUM Published 2022-12-12 Modified 2022-12-12 Official page ↗
Aliases
CVE-2022-46685
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:gitea
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-319
Reviewed
2022-12-12

Affected packages

• Maven org.jenkins-ci.plugins:gitea: < 1.4.5 → fixed in 1.4.5

Description

In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log. Gitea Plugin 1.4.5 adds support for masking of Gitea personal access tokens. Administrators unable to update are advised to use SSH checkout instead.

Related

Alias · CVE (1)

  • CVE-2022-46685 In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking,… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References