CVE-2020-2119

Опубликовано: 12 фев. 2020

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Ссылки

http://www.openwall.com/lists/oss-security/2020/02/12/3
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1717
Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/02/12/3
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1717
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:azure_ad:*:*:*:*:*:jenkins:*:*

Версия до 1.1.2 (включая)

EPSS

Процентиль: 11%

0.00038

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-522

Связанные уязвимости

GHSA-vvg2-hg3c-mqj3

CVSS3: 3.1

github

больше 3 лет назад

Client secret transmitted in plain text by Azure AD Plugin