PT-2018-15209 · Jenkins · Jenkins Maven Artifact Choicelistprovider (Nexus) Plugin+1

Viktor Gazdag · Publicado 2018-08-01 · Atualizado 2022-05-13 · CVE-2018-1999030

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin versions 1.3.1 and earlier

Description A sensitive information exposure issue exists, allowing attackers to capture credentials with a known credentials ID stored in Jenkins. This issue is related to the ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, and Nexus3ChoiceListProvider.java files.

Recommendations For Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin versions 1.3.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1999030

GHSA-FJH2-QHFH-RVFC

Produtos afetados

Jenkins

Jenkins Maven Artifact Choicelistprovider (Nexus) Plugin

Referências · 8

• https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin · Nota
• https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/5a3a3ff1e7416623c531601620305640ef4c8e28 · Nota
• https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/2d2e20cc00a29abf435afcad12cfc9ddadf76d89 · Nota
• https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/99d97c028fbc0672b729d052d4bfc4dfa9674f23 · Nota
• https://osv.dev/vulnerability/CVE-2018-1999030 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-fjh2-qhfh-rvfc · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999030 · Nota de Segurança
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1022 · Aviso do Fabricante