PT-2018-15209 · Jenkins · Jenkins Maven Artifact Choicelistprovider (Nexus) Plugin+1

Viktor Gazdag · Published 2018-08-01 · Updated 2022-05-13 · CVE-2018-1999030

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin versions 1.3.1 and earlier

Description A sensitive information exposure issue exists, allowing attackers to capture credentials with a known credentials ID stored in Jenkins. This issue is related to the ArtifactoryChoiceListProvider.java, NexusChoiceListProvider.java, and Nexus3ChoiceListProvider.java files.

Recommendations For Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin versions 1.3.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1999030

GHSA-FJH2-QHFH-RVFC

Affected Products

Jenkins

Jenkins Maven Artifact Choicelistprovider (Nexus) Plugin

References · 8

• https://osv.dev/vulnerability/CVE-2018-1999030 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fjh2-qhfh-rvfc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999030 · Security Note
• https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1022 · Vendor Advisory
• https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin · Note
• https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/5a3a3ff1e7416623c531601620305640ef4c8e28 · Note
• https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/2d2e20cc00a29abf435afcad12cfc9ddadf76d89 · Note
• https://github.com/jenkinsci/maven-artifact-choicelistprovider-plugin/commit/99d97c028fbc0672b729d052d4bfc4dfa9674f23 · Note