Description

Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835

Related Vulnerabilities

CVE-2023-34981 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2019-16543 Vulnerability in maven package com.inflectra.spiratest.plugins:inflectra-spira-integration

CVE-2022-37264 Vulnerability in npm package steal

CVE-2021-21345 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2020-13956 Vulnerability in maven package org.apache.httpcomponents.client5:httpclient5

Severity

Critical

Classification

CWE-311 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory