GHSA-8486-h39x-cx2f
Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | io.jenkins:configuration-as-code | < 0.8-alpha | 0.8-alpha |
Details
As written in the advisory (Markdown source, shown as plain text).
A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.
References
External links from the advisory. They lead to third-party sites.