Description

Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2091

Related Vulnerabilities

CVE-2019-17555 Vulnerability in maven package org.apache.olingo:odata-lib

CVE-2020-2125 Vulnerability in maven package ru.yandex.jenkins.plugins.debuilder:debian-package-builder

CVE-2014-0229 Vulnerability in maven package org.apache.hadoop:hadoop-hdfs

CVE-2010-5312 Vulnerability in npm package jquery-ui

CVE-2017-7561 Vulnerability in maven package org.jboss.resteasy:resteasy-jaxrs

Severity

Medium

Classification

CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory