PT-2022-27949 · Jenkins · Jenkins Git Plugin

Asi Greenholts · Published 2022-12-07 · Updated 2024-03-06 · CVE-2022-46685

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Gitea Plugin versions 1.4.4 and earlier

Description The implementation of Gitea personal access tokens in the Jenkins Gitea Plugin did not support credentials masking, potentially exposing them through the build log. Administrators who are unable to update the plugin are advised to use SSH checkout instead.

Recommendations For Jenkins Gitea Plugin versions 1.4.4 and earlier, update to version 1.4.5 or later, which adds support for masking of Gitea personal access tokens. As a temporary workaround for administrators unable to update, consider using SSH checkout instead of Gitea personal access tokens.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BIT-GITEA-2022-46685

CVE-2022-46685

GHSA-X3QH-53QF-JXQ9

Affected Products

Jenkins Git Plugin

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-46685 · Security Note
• https://osv.dev/vulnerability/BIT-gitea-2022-46685 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-46685 · Vendor Advisory
• https://jenkins.io/security/advisory/2022-12-07/#SECURITY-2661 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x3qh-53qf-jxq9 · Vendor Advisory
• https://github.com/jenkinsci/gitea-plugin · Note
• https://github.com/jenkinsci/gitea-plugin/commit/b3b2bd869b91f9f1312bbbbf6128cad2cd86bd8c · Note
• https://t.me/cvenotify/39613 · Telegram Post