Description

An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.

Remediation

References

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-840

Related Vulnerabilities

CVE-2023-2422 Vulnerability in maven package org.keycloak:keycloak-services

CVE-2015-1813 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2014-3679 Vulnerability in maven package org.jvnet.hudson.plugins:monitoring

CVE-2020-2283 Vulnerability in maven package org.jenkins-ci.plugins:liquibase-runner

CVE-2016-3727 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

Medium

Classification

CWE-200 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory