What is GHSA-g29v-5pwh-wxx4?

GHSA-g29v-5pwh-wxx4 is a security advisory published by GitHub Security Advisories with Medium severity. Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin

Which CVE IDs does GHSA-g29v-5pwh-wxx4 cover?

GHSA-g29v-5pwh-wxx4 covers the following CVE IDs: CVE-2023-24439. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g29v-5pwh-wxx4?

GHSA-g29v-5pwh-wxx4 has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-g29v-5pwh-wxx4?

GHSA-g29v-5pwh-wxx4 affects 1 product, including: maven/org.jenkins-ci.plugins:jira-steps:\u003c= 2.0.165.v8846cf59f3db.

GHSA-g29v-5pwh-wxx4MediumCVSS 5.5

Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin

Vendor

GitHub Security Advisories

Published

January 26, 2023

Last Modified

February 6, 2023

🔗 CVE IDs covered (1)

CVE-2023-24439 →

📋 Description

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

🎯 Affected products1

maven/org.jenkins-ci.plugins:jira-steps:<= 2.0.165.v8846cf59f3db

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2023-24439
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2774
https://github.com/advisories/GHSA-g29v-5pwh-wxx4