GitHub Advisoryadvisory · Maven

GHSA-4q47-ph87-fq4f Passwords stored in plain text by Jenkins Artifactory Plugin

LOW Published 2022-05-24 Modified 2022-12-22 Official page ↗
Aliases
CVE-2020-2164
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:artifactory
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-312, CWE-522
Reviewed
2022-12-22

Affected packages

• Maven org.jenkins-ci.plugins:artifactory: < 3.6.0 → fixed in 3.6.0

Description

Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password in plain text in the global configuration file `org.jfrog.hudson.ArtifactoryBuilder.xml`. This password can be viewed by users with access to the Jenkins controller file system. Artifactory Plugin 3.6.0 now stores the Artifactory server password encrypted. This change is effective once the global configuration is saved the next time.

Related

Alias · CVE (1)

  • CVE-2020-2164 Jenkins Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password unencrypted in its global configuration file on the… vulnerability

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References