Description

An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them.

Remediation

References

https://jenkins.io/security/advisory/2018-03-26/#SECURITY-373

Related Vulnerabilities

CVE-2018-1000183 Vulnerability in maven package com.coravy.hudson.plugins.github:github

CVE-2023-30530 Vulnerability in maven package org.jenkins-ci.plugins:consul-kv-builder

CVE-2023-46998 Vulnerability in maven package org.webjars.bowergithub.makeusabrew:bootbox

CVE-2020-5407 Vulnerability in maven package org.springframework.security:spring-security-saml2-service-provider

CVE-2018-1000169 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

Severity

High

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory