What is GHSA-cpm5-cqr9-7p79?

GHSA-cpm5-cqr9-7p79 is a security advisory published by GitHub Security Advisories with Low severity. Jenkins BigPanda Notifier Plugin Missing Password Field Masking

Which CVE IDs does GHSA-cpm5-cqr9-7p79 cover?

GHSA-cpm5-cqr9-7p79 covers the following CVE IDs: CVE-2022-41248. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cpm5-cqr9-7p79?

GHSA-cpm5-cqr9-7p79 has a CVSS v3 base score of 3.3, published by GitHub Security Advisories.

Which products are affected by GHSA-cpm5-cqr9-7p79?

GHSA-cpm5-cqr9-7p79 affects 1 product, including: maven/org.jenkins-ci.plugins:bigpanda-jenkins:\u003c= 1.4.0.

GHSA-cpm5-cqr9-7p79LowCVSS 3.3

Jenkins BigPanda Notifier Plugin Missing Password Field Masking

Vendor

GitHub Security Advisories

Published

September 22, 2022

Last Modified

May 28, 2025

🔗 CVE IDs covered (1)

CVE-2022-41248 →

📋 Description

BigPanda Notifier Plugin 1.4.0 and earlier stores the BigPanda API key unencrypted in its global configuration file BigpandaGlobalNotifier.xml on the Jenkins controller as part of its configuration.

This API key can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the API key, increasing the potential for attackers to observe and capture it.

🎯 Affected products1

maven/org.jenkins-ci.plugins:bigpanda-jenkins:<= 1.4.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2022-41248
https://www.jenkins.io/security/advisory/2022-09-21/#SECURITY-2243
http://www.openwall.com/lists/oss-security/2022/09/21/5
https://github.com/advisories/GHSA-cpm5-cqr9-7p79