Client Secret stored in plain text by Jenkins GitLab Authentication Plugin
Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global `config.xml` file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system. This client secret can be viewed by users with access to the Jenkins controller file system.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-27206US | medium6.5OT erhöht | — | ||
Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2022/03/15/2WEB
- https://github.com/jenkinsci/gitlab-oauth-pluginPACKAGE
- https://github.com/jenkinsci/gitlab-oauth-plugin/releases/tag/gitlab-oauth-1.14WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-27206ADVISORY
- https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-1891WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan