CVE-2018-1000145

{"id": "CVE-2018-1000145", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2018-04-05T13:29:00.417", "references": [{"url": "https://jenkins.io/security/advisory/2018-03-26/#SECURITY-373", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://jenkins.io/security/advisory/2018-03-26/#SECURITY-373", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them."}, {"lang": "es", "value": "Existe una vulnerabilidad de exposici\u00f3n de informaci\u00f3n sensible en el plugin Perforce en Jenkins, en versiones 1.3.36 y anteriores, en PerforcePasswordEncryptor.java que permite que atacantes con acceso al sistema de archivos local obtengan contrase\u00f1as Perforce cifradas y las descifren."}], "lastModified": "2024-11-21T03:39:47.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jenkins:perforce:*:*:*:*:*:jenkins:*:*", "vulnerable": true, "matchCriteriaId": "3592F914-E8F0-41F7-8973-1CECAE43E01E", "versionEndIncluding": "1.3.36"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}