Jenkins lambdatest-automation Plugin may expose Credentials access token
Low severity
GitHub Reviewed
Published
Oct 25, 2023
to the GitHub Advisory Database
•
Updated Nov 11, 2023
Package
Affected versions
< 1.21.0
Patched versions
1.21.0
Description
Published by the National Vulnerability Database
Oct 25, 2023
Published to the GitHub Advisory Database
Oct 25, 2023
Reviewed
Nov 2, 2023
Last updated
Nov 11, 2023
Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level.
This can result in accidental exposure of the token through the default system log.
lambdatest-automation Plugin 1.21.0 no longer logs LAMBDATEST Credentials access token.
References