CVE-2020-2297
Global infos:
Jenkins SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
CVE Status: Modified
References:
Metrics:
| Attribute | Value |
|---|---|
| Attack Complexity | LOW |
| Attack Vector | LOCAL |
| Availability Impact | NONE |
| Base Score | 3.3 |
| Base Severity | LOW |
| Confidentiality Impact | LOW |
| Integrity Impact | NONE |
| Privileges Required | LOW |
| Scope | UNCHANGED |
| User Interaction | NONE |
| Vector String | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Exploitability Score | 1.8 |
| Impact Score | 1.4 |
| Source | [email protected] |
| Type | Primary |