GHSA-fh5w-p2j4-4p8xMediumCVSS 4.3

Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin

Published
May 24, 2022
Last Modified
December 14, 2023

🔗 CVE IDs covered (1)

CVE-2020-2307 →

📋 Description

Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 includes a feature to replace placeholders in pod template and container template fields with environment variable values.

This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables.

Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 disables this feature.

🎯 Affected products4

  • maven/org.csanchez.jenkins.plugins:kubernetes:>= 1.27.0, < 1.27.4
  • maven/org.csanchez.jenkins.plugins:kubernetes:>= 1.26.0, < 1.26.5
  • maven/org.csanchez.jenkins.plugins:kubernetes:>= 1.22.0, < 1.25.4.1
  • maven/org.csanchez.jenkins.plugins:kubernetes:< 1.21.6

🔗 References (5)