Description

Jenkins Fortify on Demand Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1433

Related Vulnerabilities

CVE-2022-22984 Vulnerability in npm package snyk-sbt-plugin

CVE-2016-4988 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2019-1003031 Vulnerability in maven package org.jenkins-ci.plugins:matrix-project

CVE-2018-1000195 Vulnerability in maven package org.jenkins-ci.main:jenkins-core

CVE-2020-2135 Vulnerability in maven package org.jenkins-ci.plugins:script-security

Severity

Critical

Classification

CWE-312 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Vendor Advisory