Description

Jenkins Bitbucket Approve Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-965

Related Vulnerabilities

CVE-2021-22119 Vulnerability in maven package org.springframework.security:spring-security-oauth2-client

CVE-2021-21615 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2020-36182 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2022-41713 Vulnerability in maven package org.webjars.npm:deep-object-diff

CVE-2019-18213 Vulnerability in maven package org.lsp4xml:org.eclipse.lsp4xml.extensions.emmet

Severity

Critical

Classification

CWE-311 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory