Description

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1066

Related Vulnerabilities

CVE-2018-1336 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2022-42920 Vulnerability in maven package org.apache.bcel:bcel

CVE-2022-32287 Vulnerability in maven package org.apache.uima:uimaj-core

CVE-2021-21252 Vulnerability in maven package org.webjars:jquery-validation

CVE-2022-43396 Vulnerability in maven package org.apache.kylin:kylin-spark-engine

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory