CVE-2018-1999041 Exposure of sensitive information vulnerability
Attackers with file system access to the Jenkins master can read the API secret key from the Tinfoil Security Plugin configuration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1999041?
CVE-2018-1999041 is a medium-severity vulnerability in n/a, published on 1 Aug 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.
Weakness: CWE-200
Which versions are affected by CVE-2018-1999041?
2 open source packages ship an affected version, including com.tinfoilsecurity.plugins:tinfoil-scan. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.tinfoilsecurity.plugins:tinfoil-scan Maven | All versions | 2.0 |
com.tinfoilsecurity.plugins:tinfoil-scan Maven | All versions | 2.0 |
Products include Jenkins Tinfoil Security.
How do I fix CVE-2018-1999041?
Upgrade com.tinfoilsecurity.plugins:tinfoil-scan to 2.0 or later.
Is CVE-2018-1999041 being exploited?
There is no known exploitation of CVE-2018-1999041 in the wild and no public exploit code.
Sources
Also known as GHSA-68qx-whxm-h4c4.