CVE-2018-1999027 - An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins

Back Back to CVE browser

HIGH

An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins

Published Aug 1, 2018

7.5

HIGH

CVSS 3.0

EPSS 0.56%

Description

An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-352

CSRF

References (4)

https://github.com/advisories/GHSA-cqp4-cv7h-7jp5
Advisory
https://github.com/jenkinsci/saltstack-plugin/commit/5306bcc438ff989e4b1999a0208fd6854979999b
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1009
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1999027

Link	Providers	Tags
https://github.com/advisories/GHSA-cqp4-cv7h-7jp5		Advisory
https://github.com/jenkinsci/saltstack-plugin/commit/5306bcc438ff989e4b1999a0208fd6854979999b
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1009		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1999027