Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Affected Packages

Maven org.jenkins-ci.plugins:github-pr-coverage-status

Affected versions: 0 (last affected: 2.2.0)

Related CVEs

CVE-2023-24442

Key Information

GHSA ID

GHSA-4x65-4fjx-r7m6

Published

January 26, 2023 9:30 PM

Last Modified

February 3, 2023 8:39 PM

CVSS Score

5.0 /10

Primary Ecosystem

Maven

Primary Package

org.jenkins-ci.plugins:github-pr-coverage-status

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 25, 2025 6:33 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.