Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NJenkins Report Portal
APPJenkins≤ 0.5
🟢
PATCH DOSTĘPNY
Aktualizacja od producenta gotowa. Wdrożenie w ramach standardowego cyklu.
Tagi
CI/CD
Powiązane podatności
CVE-2023-30525HIGH8.8ten sam produkt
A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attac...
CVE-2023-30523MEDIUM4.3ten sam produkt
Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml f...
CVE-2023-30526MEDIUM6.5ten sam produkt
A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read ...
CVE-2024-23897CRITICAL9.8⚠ KEVPL ✓ten sam vendor
Jenkins CLI – odczyt dowolnych plików przez path traversal bez uwierzytelnienia
CVE-2019-1003029CRITICAL9.9⚠ KEVten sam vendor
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/...