CVE-2018-1000610

Опубликовано: 26 июн. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 4

EPSS Низкий

Описание

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.

Ссылки

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-929
Vendor Advisory
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-929
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:jenkins:configuration_as_code:0.1:alpha:*:*:*:jenkins:*:*

cpe:2.3:a:jenkins:configuration_as_code:0.2:alpha:*:*:*:jenkins:*:*

cpe:2.3:a:jenkins:configuration_as_code:0.3:alpha:*:*:*:jenkins:*:*

cpe:2.3:a:jenkins:configuration_as_code:0.4:alpha:*:*:*:jenkins:*:*

cpe:2.3:a:jenkins:configuration_as_code:0.5:alpha:*:*:*:jenkins:*:*

cpe:2.3:a:jenkins:configuration_as_code:0.6:alpha:*:*:*:jenkins:*:*

cpe:2.3:a:jenkins:configuration_as_code:0.7:alpha:*:*:*:jenkins:*:*

EPSS

Процентиль: 16%

0.00051

Низкий

8.8 High

CVSS3

4 Medium

CVSS2

Дефекты

CWE-522

Связанные уязвимости

GHSA-8486-h39x-cx2f