CVE-2020-2181

Опубликовано: 06 мая 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

Ссылки

http://www.openwall.com/lists/oss-security/2020/05/06/3
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374
Vendor Advisory
http://www.openwall.com/lists/oss-security/2020/05/06/3
Mailing List
Third Party Advisory
https://jenkins.io/security/advisory/2020-05-06/#SECURITY-1374
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:jenkins:credentials_binding:*:*:*:*:*:jenkins:*:*

Версия до 1.22 (включая)

EPSS

Процентиль: 28%

0.001

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-522

Связанные уязвимости

CVE-2020-2181

CVSS3: 6.5

redhat

почти 6 лет назад

Jenkins Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

GHSA-43j2-r4v3-m8jp

CVSS3: 5.3

github

больше 3 лет назад

Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps