Description

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Remediation

References

http://www.openwall.com/lists/oss-security/2023/04/13/3

https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-2992

Related Vulnerabilities

CVE-2021-43138 Vulnerability in maven package org.webjars.bowergithub.caolan:async

CVE-2023-33725 Vulnerability in maven package org.broadleafcommerce:broadleaf

CVE-2023-38435 Vulnerability in maven package org.apache.felix:org.apache.felix.healthcheck.webconsoleplugin

CVE-2020-14967 Vulnerability in maven package org.webjars.bower:jsrsasign

CVE-2019-10424 Vulnerability in maven package com.technicolor:eloyente

Severity

Medium

Classification

CWE-312 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Mailing List Third Party Advisory Vendor Advisory