Client Secret stored in plain text by Jenkins GitLab Authentication Plugin
Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global `config.xml` file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. This client secret can be viewed by users with access to the Jenkins controller file system.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-27206US | medium6.5OT elevated | — | ||
Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2022/03/15/2WEB
- https://github.com/jenkinsci/gitlab-oauth-pluginPACKAGE
- https://github.com/jenkinsci/gitlab-oauth-plugin/releases/tag/gitlab-oauth-1.14WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-27206ADVISORY
- https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan