Description

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2064

Related Vulnerabilities

CVE-2023-34054 Vulnerability in maven package io.projectreactor.netty:reactor-netty-http

CVE-2021-25122 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

CVE-2020-28052 Vulnerability in maven package org.bouncycastle:bcprov-jdk15to18

CVE-2022-22969 Vulnerability in maven package org.springframework.security.oauth:spring-security-oauth-parent

CVE-2020-5397 Vulnerability in maven package org.springframework:spring-webmvc

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory CWE-522