Description

Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-946

http://www.securityfocus.com/bid/107790

http://www.openwall.com/lists/oss-security/2019/04/12/2

Related Vulnerabilities

CVE-2014-0099 Vulnerability in maven package org.apache.tomcat:tomcat-coyote

CVE-2018-8039 Vulnerability in maven package org.apache.cxf:cxf-rt-transports-http

CVE-2021-32732 Vulnerability in maven package org.xwiki.platform:xwiki-platform-administration-ui

CVE-2023-43500 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2023-32314 Vulnerability in npm package vm2

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory VDB Entry Mailing List