GHSA-5r5f-hcwf-r9jh
Secret stored in plain text by Jenkins GitHub Coverage Reporter Plugin
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.jenkins.plugins:github-coverage-reporter | <= 1.10 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
GitHub Coverage Reporter Plugin 1.10 and earlier stores a GitHub access token in plain text in its global configuration file `io.jenkins.plugins.gcr.PluginConfiguration.xml`. This token can be viewed by users with access to the Jenkins controller file system.
References
External links from the advisory. They lead to third-party sites.