Description

Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Related CPE's

a

jenkins

gitlab_authentication

*

*

*

*

*

jenkins

Vulnerable

References

http://www.openwall.com/lists/oss-security/2022/03/15/2

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891

Vendor Advisory

http://www.openwall.com/lists/oss-security/2022/03/15/2

Mailing ListThird Party Advisory

https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891

Vendor Advisory

Weaknesses

[email protected]

Primary
CWE-522

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.5 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Modified

Published

2022-03-15T16:15:11.340Z

4 years ago

Last modified

2024-11-21T05:55:24.557Z

1 year ago