Jenkins Gogs Plugin stored credentials in plain text

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2019-10348 · ADVISORY
• jenkinsci/gogs-webhook-plugin commit 34de11f · WEB
• jenkins.io/security/advisory/2019-07-11 · WEB
• openwall.com/lists/oss-security/2019/07/11/4 · WEB
• securityfocus.com/bid/109156 · Third Party Advisory
• zerodayinitiative.com/advisories/ZDI-19-837 · Third Party Advisory

org.jenkins-ci.plugins:gogs-webhook のその他の脆弱性

• CVE-2023-46657中 5.3Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook …
• CVE-2023-40349中 5.3Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers t…
• CVE-2023-40348中 5.3The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in…