Description

Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835

Related Vulnerabilities

CVE-2022-39353 Vulnerability in maven package org.webjars.npm:xmldom

CVE-2021-4040 Vulnerability in maven package org.apache.activemq:artemis-commons

CVE-2022-24999 Vulnerability in npm package express

CVE-2023-37943 Vulnerability in maven package org.jenkins-ci.plugins:active-directory

CVE-2020-7727 Vulnerability in npm package gedi

Severity

Critical

Classification

CWE-311 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory