Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS0zNXJ4LTdwYzgtNjk2M84AAvdS

API keys stored in plain text by Jenkins Katalon Plugin

Jenkins Katalon Plugin 1.0.32 and earlier stores API keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration.

These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Katalon Plugin 1.0.33 no longer stores the API keys directly, instead accessing them through its Credentials Plugin integration, once affected job configurations are saved again.

Permalink: https://github.com/advisories/GHSA-35rx-7pc8-6963
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zNXJ4LTdwYzgtNjk2M84AAvdS
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 years ago
Updated: about 1 year ago

CVSS Score: 4.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS Percentage: 0.00065
EPSS Percentile: 0.29549

Identifiers: GHSA-35rx-7pc8-6963, CVE-2022-43419
References:

• https://nvd.nist.gov/vuln/detail/CVE-2022-43419
• https://www.jenkins.io/security/advisory/2022-10-19/#SECURITY-2846
• http://www.openwall.com/lists/oss-security/2022/10/19/3
• https://github.com/jenkinsci/katalon-plugin/pull/28
• https://github.com/jenkinsci/katalon-plugin/commit/64f819387f3f14d54f3a1542578a5c7aa9feb85c
• https://github.com/advisories/GHSA-35rx-7pc8-6963

Repository: https://github.com/jenkinsci/katalon-plugin
Blast Radius: 1.0

Affected Packages