Description

Jenkins Open STF Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1059

Related Vulnerabilities

CVE-2023-41080 Vulnerability in maven package org.apache.tomcat:tomcat

CVE-2021-26291 Vulnerability in maven package org.apache.maven:apache-maven

CVE-2022-24433 Vulnerability in maven package org.webjars.npm:simple-git

CVE-2021-29505 Vulnerability in maven package com.thoughtworks.xstream:xstream

CVE-2022-30618 Vulnerability in npm package strapi

Severity

High

Classification

CWE-311 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory