GHSA-rxfv-gm5x-9wqj

Jenkin allows attackers to obtain passwords by reading the HTML source code

At a glance

Published: 2022-05-17 03:53 UTC
Updated: 2024-12-03 05:57 UTC
CVE: CVE-2014-2061

Description

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

Affected packages

Package	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.533, fixed 1.551
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.532.2

References

https://nvd.nist.gov/vuln/detail/CVE-2014-2061 ADVISORY
https://github.com/jenkinsci/jenkins/commit/bf539198564a1108b7b71a973bf7de963a6213ef WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 WEB
http://www.openwall.com/lists/oss-security/2014/02/21/2 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database