Description

Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/07/31/1

https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435

https://www.zerodayinitiative.com/advisories/ZDI-19-835/

Related Vulnerabilities

CVE-2020-5258 Vulnerability in npm package dojo

CVE-2022-22984 Vulnerability in npm package snyk-docker-plugin

CVE-2019-10360 Vulnerability in maven package org.jenkins-ci.plugins.m2release:m2release

CVE-2019-10807 Vulnerability in npm package blamer

CVE-2022-24376 Vulnerability in npm package git-promise

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory VDB Entry