Description

Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.

Remediation

References

http://www.securityfocus.com/bid/108045

https://jenkins.io/security/advisory/2019-04-17/#SECURITY-844

Related Vulnerabilities

CVE-2022-38749 Vulnerability in maven package org.yaml:snakeyaml

CVE-2018-1336 Vulnerability in maven package org.apache.tomcat:tomcat-util

CVE-2022-3171 Vulnerability in maven package com.google.protobuf:protobuf-kotlin-lite

CVE-2022-25921 Vulnerability in npm package morgan-json

CVE-2018-3750 Vulnerability in npm package deep-extend

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Vendor Advisory