Description

Jenkins Google Cloud Messaging Notification Plugin 1.0 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/08/07/1

https://jenkins.io/security/advisory/2019-08-07/#SECURITY-591

Related Vulnerabilities

CVE-2019-10467 Vulnerability in maven package org.jenkins-ci.plugins:sonar-gerrit

CVE-2019-10341 Vulnerability in maven package io.jenkins.docker:docker-plugin

CVE-2019-10413 Vulnerability in maven package com.datatheorem.mobileappsecurity.jenkins.plugin:datatheorem-mobile-app-security

CVE-2022-37724 Vulnerability in maven package wonder.utilities:utilities

CVE-2019-10246 Vulnerability in maven package org.eclipse.jetty:jetty-util

Severity

High

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory