Description

Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-945

http://www.securityfocus.com/bid/107790

http://www.openwall.com/lists/oss-security/2019/04/12/2

Related Vulnerabilities

CVE-2023-49280 Vulnerability in maven package org.xwiki.contrib.changerequest:application-changerequest-default

CVE-2022-28731 Vulnerability in maven package org.apache.jspwiki:jspwiki-war

CVE-2021-35515 Vulnerability in maven package org.apache.commons:commons-compress

CVE-2020-1723 Vulnerability in maven package org.keycloak:keycloak-core

CVE-2020-2133 Vulnerability in maven package com.applatix.jenkins:applatix

Severity

Critical

Classification

CWE-311 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory VDB Entry Mailing List