CVE-2018-1000401 - Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure

Back Back to CVE browser

HIGH

Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure

Published Jul 9, 2018

7.8

HIGH

CVSS 3.0

EPSS 0.34%

Description

Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.37 and later.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2586
Advisory
https://github.com/advisories/GHSA-5gwq-4275-q4qc
Advisory
https://github.com/jenkinsci/aws-codepipeline-plugin/commit/a45d3dc52c8b6f49e813a2ee8b796f0302649c69
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-967
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000401

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2586		Advisory
https://github.com/advisories/GHSA-5gwq-4275-q4qc		Advisory
https://github.com/jenkinsci/aws-codepipeline-plugin/commit/a45d3dc52c8b6f49e813a2ee8b796f0302649c69
https://jenkins.io/security/advisory/2018-06-25/#SECURITY-967		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000401