PT-2017-10818 · Datadog+1 · Datadog Plugin+1

Alvin Huang · Published 2017-10-04 · Updated 2022-05-17 · CVE-2017-1000114

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Datadog Plugin (affected versions not specified)

Description The issue concerns the transmission of an API key in plain text as part of the configuration form, potentially exposing it through browser extensions or cross-site scripting vulnerabilities. The API key is used to access the Datadog service and is stored encrypted on disk.

Recommendations For the Datadog Plugin, update to a version that encrypts the API key transmitted to administrators viewing the global configuration form to prevent potential exposure.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-1000114

GHSA-HF7W-F4H4-9XP8

Affected Products

Datadog Plugin

Jenkins

References · 5

• https://jenkins.io/security/advisory/2017-08-07 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000114 · Security Note
• https://osv.dev/vulnerability/GHSA-hf7w-f4h4-9xp8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000114 · Vendor Advisory
• http://securityfocus.com/bid/100223 · Note