Description

Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Remediation

References

https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1434

Related Vulnerabilities

CVE-2019-1003068 Vulnerability in maven package com.inkysea.vmware.vra:vmware-vrealize-automation-plugin

CVE-2014-3630 Vulnerability in maven package com.typesafe.play:play_2.10

CVE-2020-8897 Vulnerability in maven package com.amazonaws:aws-encryption-sdk-java

CVE-2021-41182 Vulnerability in maven package org.webjars.bower:jquery-ui

CVE-2022-34178 Vulnerability in maven package org.jenkins-ci.plugins:embeddable-build-status

Severity

Low

Classification

CWE-312 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory