CVE-2018-1999040

CWE-200 — Information Exposure7 documents7 sources

Severity

8.8HIGH

EPSS

0.4%

top 41.83%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Kubernetes

Timeline

PublishedAug 1

Latest updateMay 13

Description

An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶Mavenorg.csanchez.jenkins.plugins:kubernetes< 1.10.2

▶NVDjenkins/kubernetes1.10.1

🔴Vulnerability Details

GHSA

Exposure of Sensitive Information in Jenkins Kubernetes Plugin↗2022-05-13

▶

OSV

Exposure of Sensitive Information in Jenkins Kubernetes Plugin↗2022-05-13

▶

CVEList

CVE-2018-1999040: An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1↗2018-08-01

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2018-07-30↗2018-07-30

▶

Red Hat

jenkins-plugin-kubernetes: credentials Information Exposure↗2018-07-30

▶

💬Community

Bugzilla

CVE-2018-1999040 jenkins-plugin-kubernetes: credentials Information Exposure↗2018-08-02

▶