Description

Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-946

Related Vulnerabilities

CVE-2021-32854 Vulnerability in maven package org.webjars.bower:textangular

CVE-2020-10991 Vulnerability in maven package org.mule.modules:mule-module-apikit

CVE-2020-2209 Vulnerability in maven package org.jenkins-ci.plugins:testcomplete

CVE-2023-30465 Vulnerability in maven package org.apache.inlong:manager-pojo

CVE-2021-29489 Vulnerability in npm package highcharts

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory