What is GHSA-hm57-4qpx-f734?

GHSA-hm57-4qpx-f734 is a security advisory published by GitHub Security Advisories with Low severity. Credentials transmitted in plain text by Jenkins DeployHub Plugin

Which CVE IDs does GHSA-hm57-4qpx-f734 cover?

GHSA-hm57-4qpx-f734 covers the following CVE IDs: CVE-2020-2156. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hm57-4qpx-f734?

GHSA-hm57-4qpx-f734 has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-hm57-4qpx-f734?

GHSA-hm57-4qpx-f734 affects 1 product, including: maven/com.openmake:deployhub:\u003c= 8.0.14.

GHSA-hm57-4qpx-f734LowCVSS 3.1

Credentials transmitted in plain text by Jenkins DeployHub Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2020-2156 →

📋 Description

DeployHub Plugin stores credentials in job config.xml files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by DeployHub Plugin 8.0.14 and earlier. These credentials could be viewed by users with Extended Read permission.

🎯 Affected products1

maven/com.openmake:deployhub:<= 8.0.14

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-2156
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1511
http://www.openwall.com/lists/oss-security/2020/03/09/1
https://github.com/advisories/GHSA-hm57-4qpx-f734