Jenkins Support Core Plugin stores sensitive data in plain text
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. Support Core Plugin 2.79.1 adds a list of keywords whose associated values are redacted.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-25187US | medium6.5OT elevated | — | ||
Jenkins Support Core Plugin 2.79 and earlier does not redact some sensitive information in the support bundle. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/jenkinsci/support-core-pluginPACKAGE
- https://github.com/jenkinsci/support-core-plugin/commit/c6d20da4f372f03bd3e4844f0df2f109df68a63cWEB
- https://github.com/jenkinsci/support-core-plugin/commit/e90487a87bc0a3445c887203f5badec17af905c5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-25187ADVISORY
- https://www.jenkins.io/security/advisory/2022-02-15/#SECURITY-2186WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan