Description

Jenkins Klaros-Testmanagement Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-843

Related Vulnerabilities

CVE-2022-24373 Vulnerability in npm package react-native-reanimated

CVE-2019-12416 Vulnerability in maven package org.apache.deltaspike.modules:deltaspike-jsf-module-impl

CVE-2021-23926 Vulnerability in maven package org.apache.xmlbeans:xmlbeans

CVE-2020-2150 Vulnerability in maven package org.jenkins-ci.plugins:quality-gates

CVE-2021-36774 Vulnerability in maven package org.apache.kylin:kylin-core-common

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory