Description

Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-946

Related Vulnerabilities

CVE-2023-36478 Vulnerability in maven package org.eclipse.jetty:jetty-http

CVE-2023-34468 Vulnerability in maven package org.apache.nifi:nifi-hikari-dbcp-service

CVE-2023-30527 Vulnerability in maven package org.jenkins-ci.plugins:wso2id-oauth

CVE-2023-37961 Vulnerability in maven package org.jenkins-ci.plugins:assembla-auth

CVE-2019-11002 Vulnerability in maven package org.webjars.npm:materialize-css

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory