Description

Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2019/11/21/1

https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%281%29

Related Vulnerabilities

CVE-2023-30601 Vulnerability in maven package org.apache.cassandra:cassandra-all

CVE-2023-48796 Vulnerability in maven package org.apache.dolphinscheduler:dolphinscheduler-master

CVE-2021-21266 Vulnerability in maven package org.openhab.addons.bundles:org.openhab.binding.yamahareceiver

CVE-2022-27200 Vulnerability in maven package io.jenkins.plugins:folder-auth

CVE-2020-10727 Vulnerability in maven package org.apache.activemq:artemis-server

Severity

Critical

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Mailing List Third Party Advisory