Description

Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156

Related Vulnerabilities

CVE-2023-28155 Vulnerability in maven package org.webjars.bower:request

CVE-2022-34201 Vulnerability in maven package com.convertigo.jenkins.plugins:convertigo-mobile-platform

CVE-2020-2181 Vulnerability in maven package org.jenkins-ci.plugins:credentials-binding

CVE-2019-10453 Vulnerability in maven package org.jenkins-ci.plugins:delphix

CVE-2016-2175 Vulnerability in maven package org.apache.pdfbox:jempbox

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory