GHSA-68qx-whxm-h4c4

Exposure of sensitive information vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1999041

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.tinfoilsecurity.plugins:tinfoil-scan	< 2.0	2.0

Details

As written in the advisory (Markdown source, shown as plain text).

An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1999041 advisory
https://github.com/jenkinsci/tinfoil-scan-plugin/commit/26b39449fd75213973a509accde5b3938dbd1f91 web
https://github.com/jenkinsci/tinfoil-scan-plugin package
https://jenkins.io/security/advisory/2018-07-30/#SECURITY-840 web