Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS01Z3dxLTQyNzUtcTRxY84AASkZ

Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials

Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.37 and later.

Permalink: https://github.com/advisories/GHSA-5gwq-4275-q4qc
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z3dxLTQyNzUtcTRxY84AASkZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: almost 2 years ago

CVSS Score: 7.8
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Percentage: 0.00044
EPSS Percentile: 0.13516

Identifiers: GHSA-5gwq-4275-q4qc, CVE-2018-1000401
References:

• https://nvd.nist.gov/vuln/detail/CVE-2018-1000401
• https://jenkins.io/security/advisory/2018-06-25/#SECURITY-967
• https://github.com/jenkinsci/aws-codepipeline-plugin/commit/a45d3dc52c8b6f49e813a2ee8b796f0302649c69
• https://github.com/advisories/GHSA-5gwq-4275-q4qc

Repository: https://github.com/jenkinsci/aws-codepipeline-plugin
Blast Radius: 1.0

Affected Packages