PT-2017-10818 · Datadog+1 · Datadog Plugin+1

Alvin Huang · Publicado 2017-10-04 · Atualizado 2022-05-17 · CVE-2017-1000114

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Datadog Plugin (affected versions not specified)

Description The issue concerns the transmission of an API key in plain text as part of the configuration form, potentially exposing it through browser extensions or cross-site scripting vulnerabilities. The API key is used to access the Datadog service and is stored encrypted on disk.

Recommendations For the Datadog Plugin, update to a version that encrypts the API key transmitted to administrators viewing the global configuration form to prevent potential exposure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-1000114

GHSA-HF7W-F4H4-9XP8

Produtos afetados

Datadog Plugin

Jenkins

Referências · 5

• https://jenkins.io/security/advisory/2017-08-07 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000114 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-hf7w-f4h4-9xp8 · Aviso do Fabricante
• http://securityfocus.com/bid/100223 · Nota
• https://osv.dev/vulnerability/CVE-2017-1000114 · Aviso do Fabricante