Description

Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1056

Related Vulnerabilities

CVE-2019-1003077 Vulnerability in maven package org.jenkins-ci.plugins:audit2db

CVE-2020-5497 Vulnerability in maven package org.mitre:openid-connect-common

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.vitotronic

CVE-2023-47325 Vulnerability in maven package org.silverpeas.core:silverpeas-core-web

CVE-2023-38905 Vulnerability in maven package org.jeecgframework.boot:jeecg-boot-base-core

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory