What is GHSA-q2wv-m3pq-xpv9?

GHSA-q2wv-m3pq-xpv9 is a security advisory published by GitHub Security Advisories with Low severity. Credentials transmitted in plain text by Skytap Cloud CI Plugin

Which CVE IDs does GHSA-q2wv-m3pq-xpv9 cover?

GHSA-q2wv-m3pq-xpv9 covers the following CVE IDs: CVE-2020-2157. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q2wv-m3pq-xpv9?

GHSA-q2wv-m3pq-xpv9 has a CVSS v3 base score of 3.1, published by GitHub Security Advisories.

Which products are affected by GHSA-q2wv-m3pq-xpv9?

GHSA-q2wv-m3pq-xpv9 affects 1 product, including: maven/org.jenkins-ci.plugins:skytap:\u003c= 2.07.

GHSA-q2wv-m3pq-xpv9LowCVSS 3.1

Credentials transmitted in plain text by Skytap Cloud CI Plugin

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 29, 2023

🔗 CVE IDs covered (1)

CVE-2020-2157 →

📋 Description

Skytap Cloud CI Plugin stores credentials in job config.xml files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin 2.07 and earlier. These credentials could be viewed by users with Extended Read permission.

🎯 Affected products1

maven/org.jenkins-ci.plugins:skytap:<= 2.07

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2020-2157
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1522
http://www.openwall.com/lists/oss-security/2020/03/09/1
https://github.com/advisories/GHSA-q2wv-m3pq-xpv9