CVE-2023-24442 | BDVDB-2026-193821 Detail
Jenkins ProjectJenkins GitHub Pull Request Coverage Status Plugin
Description#
Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: local.
Weaknesses#
- CWE-312 Cleartext Storage of Sensitive Information
References#
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.