Description

Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/07/31/1

https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435

https://www.zerodayinitiative.com/advisories/ZDI-19-835/

Related Vulnerabilities

CVE-2018-1000174 Vulnerability in maven package org.jenkins-ci.plugins:google-login

CVE-2020-13941 Vulnerability in maven package org.apache.solr:solr-core

CVE-2019-1003054 Vulnerability in maven package info.bluefloyd.jenkins:jenkins-jira-issue-updater

CVE-2014-7205 Vulnerability in npm package bassmaster

CVE-2021-23429 Vulnerability in npm package transpile

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory VDB Entry