Sensitive Credential Exposure in Jenkins GitHub Pull Request Coverage Status Plugin

CVE-2023-24442

What is CVE-2023-24442?

The Jenkins GitHub Pull Request Coverage Status Plugin versions prior to 2.2.0 improperly stores sensitive information, including GitHub Personal Access Tokens, Sonar access tokens, and Sonar passwords, in an unencrypted format within the global configuration file on the Jenkins controller. This security oversight allows users with access to the Jenkins controller's file system to potentially view this sensitive information, posing significant risks to the integrity and confidentiality of affected projects.

References