What is GHSA-x3qh-53qf-jxq9?

GHSA-x3qh-53qf-jxq9 is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Gitea Plugin vulnerable to Cleartext Transmission of Sensitive Information

Which CVE IDs does GHSA-x3qh-53qf-jxq9 cover?

GHSA-x3qh-53qf-jxq9 covers the following CVE IDs: CVE-2022-46685. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x3qh-53qf-jxq9?

GHSA-x3qh-53qf-jxq9 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-x3qh-53qf-jxq9?

GHSA-x3qh-53qf-jxq9 affects 1 product, including: maven/org.jenkins-ci.plugins:gitea:\u003c 1.4.5.

GHSA-x3qh-53qf-jxq9MediumCVSS 4.3

Jenkins Gitea Plugin vulnerable to Cleartext Transmission of Sensitive Information

Vendor

GitHub Security Advisories

Published

December 12, 2022

Last Modified

January 28, 2023

🔗 CVE IDs covered (1)

CVE-2022-46685 →

📋 Description

In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log.

Gitea Plugin 1.4.5 adds support for masking of Gitea personal access tokens.

Administrators unable to update are advised to use SSH checkout instead.

🎯 Affected products1

maven/org.jenkins-ci.plugins:gitea:< 1.4.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-46685
https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2661
https://github.com/jenkinsci/gitea-plugin/commit/b3b2bd869b91f9f1312bbbbf6128cad2cd86bd8c
https://github.com/advisories/GHSA-x3qh-53qf-jxq9