GitHub Advisoryadvisory · Maven

GHSA-5c97-gxr3-r368 Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file

LOW Published 2022-05-24 Modified 2022-12-06 Official page ↗
Aliases
CVE-2019-16572
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:weibo
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-1024, CWE-256, CWE-522
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.plugins:weibo: <= 1.0.1 (no fix yet)

Description

Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Related

Alias · CVE (1)

  • CVE-2019-16572 Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can… vulnerability

Weakness · CWE (3)

  • CWE-1024 Comparison of Incompatible Types weakness
  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References