Description

Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504

http://www.openwall.com/lists/oss-security/2019/09/25/3

Related Vulnerabilities

CVE-2017-7536 Vulnerability in maven package org.hibernate:hibernate-validator

CVE-2019-1003052 Vulnerability in maven package org.jenkins-ci.plugins:aws-beanstalk-publisher-plugin

CVE-2018-6873 Vulnerability in npm package auth0-js

CVE-2017-18354 Vulnerability in npm package rendertron-middleware

CVE-2020-10714 Vulnerability in maven package org.wildfly.security:wildfly-elytron

Severity

Medium

Classification

CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory Mailing List