Description

Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1056

http://www.securityfocus.com/bid/107790

http://www.openwall.com/lists/oss-security/2019/04/12/2

Related Vulnerabilities

CVE-2020-11980 Vulnerability in maven package org.apache.karaf.management:org.apache.karaf.management.server

CVE-2021-21616 Vulnerability in maven package org.biouno:uno-choice

CVE-2012-5886 Vulnerability in maven package org.apache.tomcat:tomcat-catalina

CVE-2022-31018 Vulnerability in maven package com.typesafe.play:play_2.12

CVE-2022-29822 Vulnerability in npm package feathers-sequelize

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Third Party Advisory VDB Entry Mailing List