What is GHSA-jrmf-xhr6-3428?

GHSA-jrmf-xhr6-3428 is a security advisory published by GitHub Security Advisories with High severity. Jenkins SourceGear Vault plugin transmits credentials in plain text

Which CVE IDs does GHSA-jrmf-xhr6-3428 cover?

GHSA-jrmf-xhr6-3428 covers the following CVE IDs: CVE-2019-10435. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jrmf-xhr6-3428?

GHSA-jrmf-xhr6-3428 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-jrmf-xhr6-3428?

GHSA-jrmf-xhr6-3428 affects 1 product, including: maven/org.jenkins-ci.plugins:vault-scm-plugin:\u003c= 1.1.1.

GHSA-jrmf-xhr6-3428HighCVSS 7.5

Jenkins SourceGear Vault plugin transmits credentials in plain text

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 31, 2023

🔗 CVE IDs covered (1)

CVE-2019-10435 →

📋 Description

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. As of the publication of the advisory, there are no patches and the plugin is unmaintained.

🎯 Affected products1

maven/org.jenkins-ci.plugins:vault-scm-plugin:<= 1.1.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-10435
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1524
http://www.openwall.com/lists/oss-security/2019/10/01/2
https://github.com/advisories/GHSA-jrmf-xhr6-3428