Description

An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuration.

Remediation

References

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-847

Related Vulnerabilities

CVE-2023-50728 Vulnerability in npm package @octokit/app

CVE-2021-30638 Vulnerability in maven package org.apache.tapestry:tapestry-core

CVE-2018-1999038 Vulnerability in maven package org.jenkins-ci.plugins:publish-over-cifs

CVE-2019-3778 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth2

CVE-2014-0094 Vulnerability in maven package org.apache.struts:struts2-core

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory