GitHub Advisoryadvisory · Maven
GHSA-22rj-q66g-2jg3 Jenkins GitLab Logo Plugin stores credentials unencrypted
MEDIUM
Official page ↗
- Aliases
- CVE-2019-10429
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:gitlab-logo
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-522
- Reviewed
- 2023-12-14
Affected packages
• Maven org.jenkins-ci.plugins:gitlab-logo: < 1.0.4 → fixed in 1.0.4
Description
Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Related
Alias · CVE (1)
- CVE-2019-10429 Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed… vulnerability
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10429 advisory
- https://github.com/jenkinsci/gitlab-logo-plugin/commit/1a64595353df91b5fcf2d9336fa627e06ef1f8a9 web
- https://github.com/jenkinsci/gitlab-logo-plugin package
- https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1575 web
- http://www.openwall.com/lists/oss-security/2019/09/25/3 web