GHSA-x3qh-53qf-jxq9

    Dashboard / Vulnerabilities / GHSA-x3qh-53qf-jxq9

    GHSA-x3qh-53qf-jxq9

    Published: 12 Dec 2022Last Modified: 6 Dec 2023

    Summary: Jenkins Gitea Plugin vulnerable to Cleartext Transmission of Sensitive Information

    Details: In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them through the build log. Gitea Plugin 1.4.5 adds support for masking of Gitea personal access tokens. Administrators unable to update are advised to use SSH checkout instead.

    References: https://nvd.nist.gov/vuln/detail/CVE-2022-46685, https://github.com/jenkinsci/gitea-plugin/commit/b3b2bd869b91f9f1312bbbbf6128cad2cd86bd8c, https://github.com/jenkinsci/gitea-plugin, https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2661

    Affected packages

    Package

    Name: org.jenkins-ci.plugins:gitea

    Purl: pkg:maven/org.jenkins-ci.plugins/gitea

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.4.5

    Affected versions

    1.0.0
    1.0.1
    1.0.2
    1.0.3
    1.0.4
    1.0.5
    1.0.6
    1.0.7
    1.0.8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-x3qh-53qf-jxq9 | CVE-DB