Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS01Z3dxLTQyNzUtcTRxY84AASkZ
Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials
Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.37 and later.
Permalink: https://github.com/advisories/GHSA-5gwq-4275-q4qcJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS01Z3dxLTQyNzUtcTRxY84AASkZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 2 years ago
Updated: over 1 year ago
CVSS Score: 7.8
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-5gwq-4275-q4qc, CVE-2018-1000401
References:
- https://nvd.nist.gov/vuln/detail/CVE-2018-1000401
- https://jenkins.io/security/advisory/2018-06-25/#SECURITY-967
- https://github.com/jenkinsci/aws-codepipeline-plugin/commit/a45d3dc52c8b6f49e813a2ee8b796f0302649c69
- https://github.com/advisories/GHSA-5gwq-4275-q4qc
Blast Radius: 1.0
Affected Packages
maven:com.amazonaws:aws-codepipeline
Affected Version Ranges: < 0.37Fixed in: 0.37