Description

Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2020/03/25/2

https://jenkins.io/security/advisory/2020-03-25/#SECURITY-1542%20%281%29

Related Vulnerabilities

CVE-2022-38369 Vulnerability in maven package org.apache.iotdb:iotdb-server

CVE-2022-27202 Vulnerability in maven package org.jenkins-ci.plugins:extended-choice-parameter

CVE-2021-45851 Vulnerability in npm package @frangoteam/fuxa

CVE-2021-32723 Vulnerability in npm package prismjs

CVE-2021-21422 Vulnerability in npm package mongo-express

Severity

High

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory