Description

Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1031

http://www.securityfocus.com/bid/107790

http://www.openwall.com/lists/oss-security/2019/04/12/2

Related Vulnerabilities

CVE-2022-41254 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt

CVE-2020-2169 Vulnerability in maven package org.jenkins-ci.plugins:queue-cleanup

CVE-2023-44487 Vulnerability in maven package org.eclipse.jetty.http2:http2-common

CVE-2023-34468 Vulnerability in maven package org.apache.nifi:nifi-hikari-dbcp-service

CVE-2023-28708 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory VDB Entry Mailing List