Description

Jenkins AWS CloudWatch Logs Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-830

Related Vulnerabilities

CVE-2022-24728 Vulnerability in maven package org.webjars.npm:ckeditor4

CVE-2020-26870 Vulnerability in maven package org.webjars.bower:dompurify

CVE-2019-16568 Vulnerability in maven package hudson.plugins.sctmexecutor:sctmexecutor

CVE-2023-32200 Vulnerability in maven package org.apache.jena:jena

CVE-2019-19771 Vulnerability in npm package fs-extar

Severity

Critical

Classification

CWE-311 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory