Description

An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them.

Remediation

References

https://jenkins.io/security/advisory/2018-03-26/#SECURITY-373

Related Vulnerabilities

CVE-2018-1000175 Vulnerability in maven package org.jenkins-ci.plugins:htmlpublisher

CVE-2011-5057 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2023-45143 Vulnerability in npm package undici

CVE-2015-3250 Vulnerability in maven package org.apache.directory.api:api-all

CVE-2022-24858 Vulnerability in npm package next-auth

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory