Description

Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1477

http://www.openwall.com/lists/oss-security/2019/10/23/2

Related Vulnerabilities

CVE-2015-5241 Vulnerability in maven package org.apache.juddi:juddi-client

CVE-2013-4286 Vulnerability in maven package org.apache.tomcat:coyote

CVE-2023-32070 Vulnerability in maven package org.xwiki.rendering:xwiki-rendering-syntax-annotatedhtml5

CVE-2018-1000191 Vulnerability in maven package com.blackducksoftware.integration:blackduck-detect

CVE-2022-25853 Vulnerability in npm package semver-tags

Severity

High

Classification

CWE-522 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory Mailing List Third Party Advisory