PT-2018-9463 · Jenkins · Jenkins Z/Os Connector Plugin+2

Viktor Gazdag · Publicado 2018-06-26 · Atualizado 2022-05-13 · CVE-2018-1000608

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Jenkins z/OS Connector Plugin versions 1.2.6.1 and earlier

Description A sensitive information exposure issue exists, allowing an attacker with local file system access or control of a Jenkins administrator's web browser to retrieve the configured password. This is possible due to the vulnerability in the SCLMSCM.java file. It is noted that IBM z/OS Connector Plugin version 2.0.0 and newer integrates with Credentials Plugin and no longer stores credentials itself.

Recommendations For Jenkins z/OS Connector Plugin versions 1.2.6.1 and earlier, consider updating to version 2.0.0 or newer, which integrates with the Credentials Plugin and no longer stores credentials itself, mitigating the risk of sensitive information exposure.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-1000608

GHSA-5FQ9-X9F4-X2R2

Produtos afetados

Credentials Plugin

Jenkins

Jenkins Z/Os Connector Plugin

Referências · 5

• https://github.com/jenkinsci/zos-connector-plugin · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000608 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1000608 · Aviso do Fabricante
• https://jenkins.io/security/advisory/2018-06-25/#SECURITY-950 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-5fq9-x9f4-x2r2 · Aviso do Fabricante