Description

Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, increasing the potential for attackers to observe and capture them.

Remediation

References

http://www.openwall.com/lists/oss-security/2023/12/13/4

https://www.jenkins.io/security/advisory/2023-12-13/#SECURITY-3182

Related Vulnerabilities

CVE-2020-7238 Vulnerability in maven package io.netty:netty-codec-http

CVE-2022-34200 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2014-3623 Vulnerability in maven package org.apache.cxf:cxf

CVE-2022-45802 Vulnerability in maven package org.apache.streampark:streampark-common_2.12

CVE-2019-10422 Vulnerability in maven package org.ukiuni.callotherjenkins:call-remote-job-plugin

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Vendor Advisory CWE-312