What is GHSA-3p8r-p4q5-mc44?

GHSA-3p8r-p4q5-mc44 is a security advisory published by GitHub Security Advisories with Medium severity. Violation Comments to GitLab Plugin has Insufficiently Protected Credentials

Which CVE IDs does GHSA-3p8r-p4q5-mc44 cover?

GHSA-3p8r-p4q5-mc44 covers the following CVE IDs: CVE-2019-10416. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3p8r-p4q5-mc44?

GHSA-3p8r-p4q5-mc44 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-3p8r-p4q5-mc44?

GHSA-3p8r-p4q5-mc44 affects 1 product, including: maven/org.jenkins-ci.plugins:violation-comments-to-gitlab:\u003c 2.29.

GHSA-3p8r-p4q5-mc44MediumCVSS 4.3

Violation Comments to GitLab Plugin has Insufficiently Protected Credentials

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 22, 2023

🔗 CVE IDs covered (1)

CVE-2019-10416 →

📋 Description

Violation Comments to GitLab Plugin stored API tokens unencrypted in job config.xml files and its global configuration file org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Violation Comments to GitLab Plugin now stores these credentials encrypted. Existing jobs need to have their configuration saved for existing plain text credentials to be overwritten.

🎯 Affected products1

maven/org.jenkins-ci.plugins:violation-comments-to-gitlab:< 2.29

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-10416
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1577
http://www.openwall.com/lists/oss-security/2019/09/25/3
https://github.com/jenkinsci/violation-comments-to-gitlab-plugin/commit/e8237a803012bae7773d8bd10fe02e21892be3fe
https://github.com/advisories/GHSA-3p8r-p4q5-mc44