Description

Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2089

Related Vulnerabilities

CVE-2019-0233 Vulnerability in maven package org.apache.struts:struts2-core

CVE-2022-26594 Vulnerability in maven package com.liferay:com.liferay.dynamic.data.mapping.form.field.type

CVE-2018-1190 Vulnerability in maven package org.cloudfoundry.identity:cloudfoundry-identity-model

CVE-2021-21277 Vulnerability in maven package org.webjars.npm:angular-expressions

CVE-2023-6393 Vulnerability in maven package io.quarkus:quarkus-cache

Severity

High

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory