Description

Jenkins AWS Elastic Beanstalk Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-831

Related Vulnerabilities

CVE-2020-2117 Vulnerability in maven package org.jenkins-ci.plugins:pipeline-githubnotify-step

CVE-2020-11022 Vulnerability in maven package org.fujion.webjars:jquery

CVE-2022-43415 Vulnerability in maven package org.jenkins-ci.plugins:repo

CVE-2019-16558 Vulnerability in maven package com.inflectra.spiratest.plugins:inflectra-spira-integration

CVE-2016-5003 Vulnerability in maven package org.apache.xmlrpc:xmlrpc

Severity

Critical

Classification

CWE-311 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory