Description

Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the Jenkins master where they could be viewed by users with access to the master file system.

Remediation

References

http://www.securityfocus.com/bid/108045

https://jenkins.io/security/advisory/2019-04-17/#SECURITY-844

Related Vulnerabilities

CVE-2017-2607 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2020-10991 Vulnerability in maven package org.mule.modules:mule-module-apikit

CVE-2018-12544 Vulnerability in maven package io.vertx:vertx-web-api-contract

CVE-2020-5251 Vulnerability in npm package parse-server

CVE-2022-25878 Vulnerability in npm package protobufjs

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Third Party Advisory VDB Entry Vendor Advisory