Description

An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.

Remediation

References

https://jenkins.io/security/advisory/2018-03-26/#SECURITY-261

Related Vulnerabilities

CVE-2019-16548 Vulnerability in maven package org.jenkins-ci.plugins:google-compute-engine

CVE-2023-29526 Vulnerability in maven package org.xwiki.platform:xwiki-platform-rendering-async-macro

CVE-2021-33036 Vulnerability in maven package org.apache.hadoop:hadoop-yarn-server-common

CVE-2023-30513 Vulnerability in maven package org.csanchez.jenkins.plugins:kubernetes

CVE-2022-44729 Vulnerability in maven package org.apache.xmlgraphics:batik-transcoder

Severity

High

Classification

CWE-200 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory