Description

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier transmits configured passwords in plain text as part of its global Jenkins configuration form, potentially resulting in their exposure.

Remediation

References

https://jenkins.io/security/advisory/2020-07-02/#SECURITY-1656

http://www.openwall.com/lists/oss-security/2020/07/02/7

Related Vulnerabilities

CVE-2012-5887 Vulnerability in maven package tomcat:catalina

CVE-2023-49145 Vulnerability in maven package org.apache.nifi:nifi-jolt-transform-json-ui

CVE-2023-43501 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2016-0714 Vulnerability in maven package org.apache.tomcat:catalina

CVE-2013-4590 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-jasper

Severity

Medium

Classification

CWE-319 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Tags

Vendor Advisory Third Party Advisory