Description

Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-959

http://www.securityfocus.com/bid/107790

http://www.openwall.com/lists/oss-security/2019/04/12/2

Related Vulnerabilities

CVE-2022-45688 Vulnerability in maven package cn.hutool:hutool-json

CVE-2020-2208 Vulnerability in maven package org.jenkins-ci.plugins:slack-uploader

CVE-2023-31826 Vulnerability in maven package org.skyscreamer:nevado-jms

CVE-2023-23936 Vulnerability in maven package org.webjars.npm:undici

CVE-2021-30179 Vulnerability in maven package org.apache.dubbo:dubbo

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory VDB Entry Mailing List