What is GHSA-chm8-wp3h-f4m3?

GHSA-chm8-wp3h-f4m3 is a security advisory published by GitHub Security Advisories with High severity. Jenkins jira-ext Plugin stores credentials unencrypted

Which CVE IDs does GHSA-chm8-wp3h-f4m3 cover?

GHSA-chm8-wp3h-f4m3 covers the following CVE IDs: CVE-2019-10302. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-chm8-wp3h-f4m3?

GHSA-chm8-wp3h-f4m3 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-chm8-wp3h-f4m3?

GHSA-chm8-wp3h-f4m3 affects 1 product, including: maven/org.jenkins-ci.plugins:jira-ext:\u003c 0.9.

GHSA-chm8-wp3h-f4m3HighCVSS 8.8

Jenkins jira-ext Plugin stores credentials unencrypted

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 5, 2023

🔗 CVE IDs covered (1)

CVE-2019-10302 →

📋 Description

Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file hudson.plugins.jira.JiraProjectProperty.xml on the Jenkins master. These credentials could be viewed by users with access to the Jenkins master file system.

jira-ext Plugin version 0.9 stores credentials encrypted.

🎯 Affected products1

maven/org.jenkins-ci.plugins:jira-ext:< 0.9

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-10302
https://jenkins.io/security/advisory/2019-04-17/#SECURITY-836
http://www.securityfocus.com/bid/108045
https://github.com/jenkinsci/jira-ext-plugin/commit/e252f4084089e5cfb4c7bad389d3d20f3ec594fb
https://github.com/advisories/GHSA-chm8-wp3h-f4m3