Description

Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1432

Related Vulnerabilities

CVE-2020-1956 Vulnerability in maven package org.apache.kylin:kylin-core-common

CVE-2023-24425 Vulnerability in maven package com.cloudbees.jenkins.plugins:kubernetes-credentials-provider

CVE-2021-41303 Vulnerability in maven package org.apache.shiro:shiro-core

CVE-2019-3772 Vulnerability in maven package org.springframework.integration:spring-integration-ws

CVE-2023-29203 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory