What is GHSA-5gwq-4275-q4qc?

GHSA-5gwq-4275-q4qc is a security advisory published by GitHub Security Advisories with High severity. Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials

Which CVE IDs does GHSA-5gwq-4275-q4qc cover?

GHSA-5gwq-4275-q4qc covers the following CVE IDs: CVE-2018-1000401. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-5gwq-4275-q4qc?

GHSA-5gwq-4275-q4qc has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-5gwq-4275-q4qc?

GHSA-5gwq-4275-q4qc affects 1 product, including: maven/com.amazonaws:aws-codepipeline:\u003c 0.37.

GHSA-5gwq-4275-q4qcHighCVSS 7.8

Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2018-1000401 →

📋 Description

Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.37 and later.

🎯 Affected products1

maven/com.amazonaws:aws-codepipeline:< 0.37

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000401
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-967
https://github.com/jenkinsci/aws-codepipeline-plugin/commit/a45d3dc52c8b6f49e813a2ee8b796f0302649c69
https://github.com/advisories/GHSA-5gwq-4275-q4qc