PT-2014-3100 · Jenkins · Jenkins Subversion Plugin

Lennart Starr · Publicado 2014-05-08 · Atualizado 2023-02-13 · CVE-2013-6372

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Média

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jenkins Subversion plugin versions prior to 1.54

Description The issue allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file, due to the storage of credentials using base64 encoding.

Recommendations For versions prior to 1.54, update to version 1.54 or later to resolve the issue.

Exploit

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

CWE-255

Identificadores relacionados

CVE-2013-6372

GHSA-C4FR-GX5W-8QF2

Produtos afetados

Jenkins Subversion Plugin

Referências · 8

• 🔥 https://github.com/jenkinsci/subversion-plugin/commit/7d4562d6f7e40de04bbe29577b51c79f07d05ba6 · Exploit
• https://github.com/jenkinsci/subversion-plugin · Nota
• https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6372 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2013-6372 · Nota
• https://osv.dev/vulnerability/GHSA-c4fr-gx5w-8qf2 · Aviso do Fabricante
• https://access.redhat.com/errata/RHBA-2014:1630 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1032391 · Nota