Description

Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-963

Related Vulnerabilities

CVE-2021-45456 Vulnerability in maven package org.apache.kylin:kylin-server-base

CVE-2022-23617 Vulnerability in maven package org.xwiki.platform:xwiki-platform-oldcore

CVE-2020-7713 Vulnerability in npm package arr-flatten-unflatten

CVE-2019-3778 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth2

CVE-2020-15232 Vulnerability in maven package org.mapfish.print:print-standalone

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory