Sensitive Information Exposure in Jenkins Gitlab Hook Plugin

CVE-2018-1000196 · MEDIUM Severity

AV:N/AC:L/AU:S/C:P/I:N/A:N

A exposure of sensitive information vulnerability exists in Jenkins Gitlab Hook Plugin 1.4.2 and older in gitlab_notifier.rb, views/gitlab_notifier/global.erb that allows attackers with local Jenkins master file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured Gitlab token.

Learn more about our Web App Pen Testing.