Description

Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodeDeployPublisher.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 1.20 and later.

Remediation

References

https://jenkins.io/security/advisory/2018-06-25/#SECURITY-833

Related Vulnerabilities

CVE-2018-1000147 Vulnerability in maven package org.jvnet.hudson.plugins:perforce

CVE-2020-14446 Vulnerability in maven package org.wso2.carbon.identity.framework:org.wso2.carbon.policyeditor.ui

CVE-2022-34799 Vulnerability in maven package org.jenkins-ci.plugins:ec2-deployment-dashboard

CVE-2018-1274 Vulnerability in maven package org.springframework.data:spring-data-commons

CVE-2023-50422 Vulnerability in maven package com.sap.cloud.security:java-security

Severity

High

Classification

CWE-522 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory