Description

Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2089

Related Vulnerabilities

CVE-2018-10899 Vulnerability in maven package org.jolokia:jolokia-core

CVE-2014-3623 Vulnerability in maven package org.apache.cxf:cxf-rt-ws-security

CVE-2020-11971 Vulnerability in maven package org.apache.camel:camel-management

CVE-2022-34817 Vulnerability in maven package de.einsundeins.jenkins.plugins.failedjobdeactivator:failedjobdeactivator

CVE-2021-27807 Vulnerability in maven package org.apache.pdfbox:pdfbox

Severity

High

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Vendor Advisory