Description

Jenkins Dingding[ι’‰ι’‰] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/10/01/2

https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1423

https://www.zerodayinitiative.com/advisories/ZDI-19-862/

Related Vulnerabilities

CVE-2022-2256 Vulnerability in maven package org.keycloak:keycloak-themes

CVE-2021-43309 Vulnerability in npm package uri-template-lite

CVE-2019-10422 Vulnerability in maven package org.ukiuni.callotherjenkins:call-remote-job-plugin

CVE-2022-22912 Vulnerability in npm package plist

CVE-2019-10288 Vulnerability in maven package de.e-nexus:jabber-server-plugin

Severity

Low

Classification

CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory VDB Entry