GHSA-rxfv-gm5x-9wqj

Jenkin allows attackers to obtain passwords by reading the HTML source code

En bref

Publiée: 2022-05-17 03:53 UTC
Mise à jour: 2024-12-03 05:57 UTC
CVE: CVE-2014-2061

Description

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

Paquets affectés

Paquet	Versions
Maven · org.jenkins-ci.main:jenkins-core	introduced 1.533, fixed 1.551
Maven · org.jenkins-ci.main:jenkins-core	introduced 0, fixed 1.532.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2014-2061 ADVISORY
https://github.com/jenkinsci/jenkins/commit/bf539198564a1108b7b71a973bf7de963a6213ef WEB
https://github.com/jenkinsci/jenkins PACKAGE
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 WEB
http://www.openwall.com/lists/oss-security/2014/02/21/2 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database