Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-2143

Jenkins Logstash Plugin 2.3.1 and earlier transmits configured credentials in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

VectorNETWORK

PublishedMar 09, 2020, 16:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:logstash(Maven)02.3.2N/A

References

http://www.openwall.com/lists/oss-security/2020/03/09/1
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1516

Weakness Type

CWE-319

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK