~ / search / GHSA-gqxr-hvrw-6hfh

GHSA-gqxr-hvrw-6hfh

Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking

Source: GitHub Advisory Database (reviewed) Low CVE-2023-33000

Packages

EcosystemPackageAffectedFixed in
Maven io.jenkins.plugins:cavisson-ns-nd-integration < 4.11.0.48 4.11.0.48

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins NS-ND Integration Performance Publisher Plugin stores credentials in job config.xml files on the Jenkins controller as part of its configuration. While these credentials are stored encrypted on disk, in NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them. NS-ND Integration Performance Publisher Plugin 4.11.0.48 masks credentials displayed on the configuration form.

References

External links from the advisory. They lead to third-party sites.