Description

Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-959

Related Vulnerabilities

CVE-2018-20843 Vulnerability in npm package dbus

CVE-2019-10804 Vulnerability in npm package serial-number

CVE-2021-30246 Vulnerability in maven package org.webjars.bowergithub.kjur:jsrsasign

CVE-2020-7649 Vulnerability in npm package snyk-broker

CVE-2015-5253 Vulnerability in maven package org.apache.cxf:cxf-rt-rs-security-sso-saml

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory