Description

Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/04/12/2

http://www.securityfocus.com/bid/107790

https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1090

Related Vulnerabilities

CVE-2020-2248 Vulnerability in maven package org.jenkins-ci.plugins:jsgames

CVE-2022-23059 Vulnerability in maven package com.shopizer:shopizer

CVE-2023-44487 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2023-43500 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2022-35961 Vulnerability in maven package org.webjars.npm:openzeppelin__contracts

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory VDB Entry Vendor Advisory CWE-522