CVE-2018-1000608 Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password
An attacker with local access or browser control can retrieve the configured password from the Jenkins z/OS Connector Plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000608?
CVE-2018-1000608 is a high-severity vulnerability in n/a, published on 26 Jun 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured password.
Weakness: CWE-522
Which versions are affected by CVE-2018-1000608?
2 open source packages ship an affected version, including org.jenkins-ci.plugins:zos-connector. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.jenkins-ci.plugins:zos-connector Maven | All versions | 2.0.0 |
org.jenkins-ci.plugins:zos-connector Maven | All versions | 2.0.0 |
Products include Jenkins Z\/Os Connector.
How do I fix CVE-2018-1000608?
Upgrade org.jenkins-ci.plugins:zos-connector to 2.0.0 or later.
Is CVE-2018-1000608 being exploited?
There is no known exploitation of CVE-2018-1000608 in the wild and no public exploit code.
Sources
Also known as GHSA-5fq9-x9f4-x2r2.