Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the potential for attackers to observe and capture them.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NJenkins Report Portal
APPJenkins≤ 0.5
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
CI/CD
Related vulnerabilities
CVE-2023-30525HIGH8.8ten sam produkt
A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attac...
CVE-2023-30523MEDIUM4.3ten sam produkt
Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml f...
CVE-2023-30526MEDIUM6.5ten sam produkt
A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read ...
CVE-2024-23897CRITICAL9.8⚠ KEVPL ✓ten sam vendor
Jenkins CLI – odczyt dowolnych plików przez path traversal bez uwierzytelnienia
CVE-2019-1003029CRITICAL9.9⚠ KEVten sam vendor
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/...