Description

Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/09/25/3

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1504

Related Vulnerabilities

CVE-2023-29209 Vulnerability in maven package org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro

CVE-2022-36882 Vulnerability in maven package org.jenkins-ci.plugins:git

CVE-2022-41233 Vulnerability in maven package org.jenkins-ci.plugins:rundeck

CVE-2023-2798 Vulnerability in maven package net.sourceforge.htmlunit:htmlunit

CVE-2020-2239 Vulnerability in maven package org.jenkins-ci.plugins:parameterized-remote-trigger

Severity

Medium

Classification

CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Vendor Advisory