Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2022-41248

Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers to observe and capture it.

VectorNETWORK

PublishedSep 21, 2022, 16:15

Published Byjenkinsci-cert@googlegroups.com

Base Score

Score5.3

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

org.jenkins-ci.plugins:bigpanda-jenkins(Maven)0N/AN/A

References

http://www.openwall.com/lists/oss-security/2022/09/21/5
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2243

Weakness Type

CWE-312

CVSS Metrics

Base Score

5.3

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK