Description

Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-955

Related Vulnerabilities

CVE-2021-32729 Vulnerability in maven package org.xwiki.platform:xwiki-platform-security-authentication-script

CVE-2015-8855 Vulnerability in maven package org.webjars.bower:semver

CVE-2023-37954 Vulnerability in maven package com.sonyericsson.hudson.plugins.rebuild:rebuild

CVE-2019-5458 Vulnerability in npm package http-file-server

CVE-2020-8203 Vulnerability in maven package org.webjars.bowergithub.lodash:lodash

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory