Description

An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.

Remediation

References

https://jenkins.io/security/advisory/2018-07-30/#SECURITY-1009

Related Vulnerabilities

CVE-2019-10295 Vulnerability in maven package org.jenkins-ci.plugins:crittercism-dsym

CVE-2022-22968 Vulnerability in maven package org.springframework:spring-context

CVE-2023-50774 Vulnerability in maven package org.jenkins-ci.plugins:htmlresource

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth-parent

CVE-2019-16542 Vulnerability in maven package org.jenkins-ci.plugins:anchore-container-scanner

Severity

High

Classification

CWE-352 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Tags

Vendor Advisory