CVE-2017-1000114 Exposure of Sensitive Information in Jenkins Datadog plugin
Attackers can steal Datadog API keys transmitted in plaintext during Jenkins configuration, potentially compromising monitoring services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-1000114?
CVE-2017-1000114 is a low-severity vulnerability in n/a, published on 4 Oct 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser extensions or cross-site scripting vulnerabilities. The Datadog Plugin now encrypts the API key transmitted to administrators viewing the global configuration form.
Weakness: CWE-200
Which versions are affected by CVE-2017-1000114?
2 open source packages ship an affected version, including org.datadog.jenkins.plugins:datadog. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.datadog.jenkins.plugins:datadog Maven | All versions | 0.6.2 |
org.datadog.jenkins.plugins:datadog Maven | All versions | 0.6.2 |
Products include Jenkins Datadog.
How do I fix CVE-2017-1000114?
Upgrade org.datadog.jenkins.plugins:datadog to 0.6.2 or later.
Is CVE-2017-1000114 being exploited?
There is no known exploitation of CVE-2017-1000114 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hf7w-f4h4-9xp8.