GHSA-ffj8-w4rj-vr7v
ECS Publisher Plugin stored and displayed API token in plain text
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | de.eacg:ecs-publisher | < 1.0.1 | 1.0.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration.
References
External links from the advisory. They lead to third-party sites.