Description

Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2020/02/12/3

https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1559

Related Vulnerabilities

CVE-2021-32803 Vulnerability in npm package tar

CVE-2023-36478 Vulnerability in maven package org.eclipse.jetty.http2:http2-hpack

CVE-2023-31579 Vulnerability in maven package top.tangyh.basic:lamp-util

CVE-2022-3509 Vulnerability in maven package com.google.protobuf:protobuf-java

CVE-2022-25948 Vulnerability in npm package liquidjs

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory