Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS
Moderate severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Dec 15, 2023
Description
Published by the National Vulnerability Database
Feb 6, 2019
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Oct 25, 2023
Last updated
Dec 15, 2023
Jenkins Token Macro Plugin recursively applied token expansion.
This could be used by users able to affect input to token expansion (such as change log messages), to inject additional tokens into the input, which would then be expanded, resulting in information disclosure (for example values of environment variables), or denial of service.
Most tokens have been changed to no longer recursively apply token expansion.
References