CVE-2017-1000114
Low
Description
The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser extensions or cross-site scripting vulnerabilities. The Datadog Plugin now encrypts the API key transmitted to administrators viewing the global configuration form.
SeverityLow
CVSS3.1
Exploit probability—
Product
Jenkins Datadog
PublishedOct 5, 2017
First seenOct 5, 2017
How to fix
Update
- org.datadog.jenkins.plugins:datadog0.6.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jenkins datadog | v ≤ 0.5.6 | — |
| org.datadog.jenkins.plugins:datadogMaven | v < 0.6.2 | 0.6.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.