Description

Jenkins Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-2156

Related Vulnerabilities

CVE-2019-12421 Vulnerability in maven package org.apache.nifi:nifi-framework

CVE-2023-43500 Vulnerability in maven package com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer

CVE-2022-24728 Vulnerability in maven package org.webjars.npm:ckeditor4

CVE-2018-14658 Vulnerability in maven package org.keycloak:keycloak-services

CVE-2023-37908 Vulnerability in maven package org.xwiki.rendering:xwiki-rendering-xml

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory