Homepage
About Snyk

Information Exposure Affecting org.jenkins-ci.plugins:git-client package, versions [,2.4.4)

0.0
low

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.04% (12th percentile)
Expand this section
NVD
3.3 low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGJENKINSCIPLUGINS-32198
  • published 9 Apr 2018
  • disclosed 27 Apr 2017
  • credit Steven Christou
Report a new vulnerability Found a mistake?

Introduced: 27 Apr 2017

CVE-2017-1000242 Open this link in a new tab
CWE-200 Open this link in a new tab

How to fix?

Upgrade org.jenkins-ci.plugins:git-client to version 2.4.4 or higher.

Overview

org.jenkins-ci.plugins:git-client is extracted from git-plugin to make it easier for other plugins to use and contribute new features.

Affected versions of this package are vulnerable to Information Exposure. Temporary files were previously written to the Java temporary directory with default permissions. A malicious actor with local file access could have captured sensitive information by reading files from that directory.