What is GHSA-jcwj-j574-8j2c?

GHSA-jcwj-j574-8j2c is a security advisory published by GitHub Security Advisories with Low severity. Jenkins Azure AD Plugin stored the client secret unencrypted

Which CVE IDs does GHSA-jcwj-j574-8j2c cover?

GHSA-jcwj-j574-8j2c covers the following CVE IDs: CVE-2019-10318. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jcwj-j574-8j2c?

GHSA-jcwj-j574-8j2c has a CVSS v3 base score of 3.3, published by GitHub Security Advisories.

Which products are affected by GHSA-jcwj-j574-8j2c?

GHSA-jcwj-j574-8j2c affects 1 product, including: maven/org.jenkins-ci.plugins:azure-ad:\u003c= 0.3.3.

GHSA-jcwj-j574-8j2cLowCVSS 3.3

Jenkins Azure AD Plugin stored the client secret unencrypted

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

December 5, 2023

🔗 CVE IDs covered (1)

CVE-2019-10318 →

📋 Description

Jenkins Azure AD Plugin stored the client secret unencrypted in the global config.xml configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

Azure AD Plugin now stores the client secret encrypted.

🎯 Affected products1

maven/org.jenkins-ci.plugins:azure-ad:<= 0.3.3

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-10318
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390
http://www.openwall.com/lists/oss-security/2019/04/30/5
https://web.archive.org/web/20200227073756/http://www.securityfocus.com/bid/108159
https://github.com/jenkinsci/azure-ad-plugin/commit/70983d1a6528847ccd6e7f124450c578c42d194f
https://github.com/advisories/GHSA-jcwj-j574-8j2c