Advisory details:
github_osv / GHSA-485q-v457-3p58
| Advisory ID | github_osv/GHSA-485q-v457-3p58 |
| Aliases |
CVE-2020-2318
|
| Summary | Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 5.9 |
| Risk | 3.0 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-522 | Insufficiently Protected Credentials |
| CWE-256 | Plaintext Storage of a Password |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 6.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-485q-v457-3p58/GHSA-485q-v457-3p58.json |
| generic_textual | MODERATE |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/jenkinsci/mail-commander-plugin | ||
| https://www.jenkins.io/security/advisory/2020-11-04/#SECURITY-2085 | ||
| CVE-2020-2318 | https://nvd.nist.gov/vuln/detail/CVE-2020-2318 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.