Description

Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-831

http://www.securityfocus.com/bid/107790

http://www.openwall.com/lists/oss-security/2019/04/12/2

Related Vulnerabilities

CVE-2021-21141 Vulnerability in maven package org.webjars.npm:electron

CVE-2019-16552 Vulnerability in maven package com.sonyericsson.hudson.plugins.gerrit:gerrit-trigger

CVE-2018-1273 Vulnerability in maven package org.springframework.data:spring-data-commons

CVE-2015-5349 Vulnerability in maven package org.apache.directory.studio:org.apache.directory.studio.plugins-parent

CVE-2021-29418 Vulnerability in npm package netmask

Severity

Critical

Classification

CWE-311 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory VDB Entry Mailing List