Description

Jenkins Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.

Remediation

References

https://www.jenkins.io/security/advisory/2022-06-30/#SECURITY-2055

Related Vulnerabilities

CVE-2018-15801 Vulnerability in maven package org.springframework.security:spring-security-oauth2-jose

CVE-2019-10421 Vulnerability in maven package org.jenkins-ci.plugins:azure-event-grid-notifier

CVE-2019-1003047 Vulnerability in maven package org.jenkins-ci.plugins:fortify-on-demand-uploader

CVE-2017-5662 Vulnerability in maven package org.eclipse.birt.runtime:org.apache.batik.dom

CVE-2019-8331 Vulnerability in maven package org.webjars.bowergithub.jasny:bootstrap

Severity

Medium

Classification

CWE-522 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Vendor Advisory