medium6.5
CVE-2024-28154
Jenkins MQ Notifier Plugin exposes sensitive information in build logs
Impact
Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by default.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | com.sonymobile.jenkins.plugins.mq:mq-notifier | < 1.4.1 | 1.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Mq Notifier | before 1.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2024/03/06/3
- https://www.jenkins.io/security/advisory/2024-03-06/#SECURITY-3180
- https://github.com/advisories/GHSA-8fm4-r23p-v68v
- https://nvd.nist.gov/vuln/detail/CVE-2024-28154
- https://github.com/jenkinsci/mq-notifier-plugin/commit/46c9f228a3317eb87562bc3d99f7e184bdcecbfe