Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-1999041

CVE-2018-1999041: Exposure of sensitive information vulnerability

5.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-1999041
GHSA ID
GHSA-68qx-whxm-h4c4
EPSS Score
0.02061%
CWE
CWE-200
Published
5/14/2022
Updated
12/20/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
com.tinfoilsecurity.plugins:tinfoil-scanmaven< 2.02.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from storing API credentials in plain text within plugin configurations. The pre-patch code in TinfoilScanRecorder.java contained explicit handling of API secret keys via getAPISecretKey() and global configuration via DescriptorImpl.configure(). The commit replaced these with credential ID references to Jenkins' secure credential storage, confirming these functions were the exposure points. The CVE description explicitly mentions unencrypted storage in configuration files, aligning with these functions' pre-patch behavior.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n *xposur* o* s*nsitiv* in*orm*tion vuln*r**ility *xists in J*nkins Tin*oil S**urity Plu*in *.*.* *n* **rli*r in Tin*oilS**nR**or**r.j*v* t**t *llows *tt**k*rs wit* *il* syst*m ****ss to t** J*nkins m*st*r to o*t*in t** *PI s**r*t k*y stor** in t*is

Reasoning

T** vuln*r**ility st*mm** *rom storin* *PI *r***nti*ls in pl*in t*xt wit*in plu*in *on*i*ur*tions. T** pr*-p*t** *o** in `Tin*oilS**nR**or**r.j*v*` *ont*in** *xpli*it **n*lin* o* *PI s**r*t k*ys vi* `**t*PIS**r*tK*y()` *n* *lo**l *on*i*ur*tion vi* `*