Description

Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2020/09/16/3

https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-2014

Related Vulnerabilities

CVE-2015-8861 Vulnerability in maven package org.webjars:handlebars

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.yamahareceiver

CVE-2023-40037 Vulnerability in maven package org.apache.nifi:nifi-dbcp-base

CVE-2020-13955 Vulnerability in maven package org.apache.calcite:calcite-core

CVE-2019-19919 Vulnerability in maven package org.webjars.bower:handlebars

Severity

Medium

Classification

CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Third Party Advisory Vendor Advisory