Description

Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1574

http://www.openwall.com/lists/oss-security/2019/09/25/3

Related Vulnerabilities

CVE-2022-22965 Vulnerability in maven package org.springframework:spring-webflux

CVE-2023-47112 Vulnerability in maven package org.rundeck:rundeck

CVE-2022-25927 Vulnerability in npm package ua-parser-js

CVE-2023-3894 Vulnerability in maven package com.fasterxml.jackson.dataformat:jackson-dataformat-properties

CVE-2017-3156 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-jose

Severity

High

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Mailing List Third Party Advisory