Advisory details:
github_osv / GHSA-m3wv-fr8v-fmh7
| Advisory ID | github_osv/GHSA-m3wv-fr8v-fmh7 |
| Aliases |
CVE-2017-1000387
|
| Summary | Jenkins Build-Publisher plugin has Insufficiently Protected Credentials Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file `hudson.plugins.build_publisher.BuildPublisher.xml` in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations. Build-Publisher Plugin 1.22 encrypts the credentials on disk, and only transmits their encrypted form to users viewing the configuration form. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 7.0 |
| Risk | 3.5 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3 | 7.8 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-m3wv-fr8v-fmh7/GHSA-m3wv-fr8v-fmh7.json |
| generic_textual | HIGH |
| Reference id | Reference type | URL |
|---|---|---|
| https://jenkins.io/security/advisory/2017-10-23 | ||
| http://www.securityfocus.com/bid/101544 | ||
| CVE-2017-1000387 | https://nvd.nist.gov/vuln/detail/CVE-2017-1000387 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.