Description

Jenkins CodeScan Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/09/25/3

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1551

Related Vulnerabilities

CVE-2019-25158 Vulnerability in npm package tts-api

CVE-2022-21144 Vulnerability in npm package libxmljs

CVE-2019-5432 Vulnerability in npm package mqtt-packet

CVE-2019-10303 Vulnerability in maven package org.jenkins-ci.plugins:azure-publishersettings-credentials

CVE-2019-16869 Vulnerability in maven package io.netty:netty-all

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory