Description

Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/10/16/6

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1450

Related Vulnerabilities

CVE-2022-45146 Vulnerability in maven package org.bouncycastle:bc-fips-debug

CVE-2020-15095 Vulnerability in npm package npm

CVE-2022-45385 Vulnerability in maven package org.jenkins-ci.plugins:dockerhub-notification

CVE-2022-36127 Vulnerability in npm package skywalking-backend-js

CVE-2022-0624 Vulnerability in npm package parse-path

Severity

High

Classification

CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory Vendor Advisory