CVE-2018-1000610

Description

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.

Risk Information

Base Score

8.8

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.051

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2018-1000609,CVE-2018-1000610 are fixed in Jenkins - configuration-as-code 0.8	Windows
Vulnerabilities CVE-2018-1000609,CVE-2018-1000610 are fixed in Jenkins - configuration-as-code for Linux 0.8	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234