GitHub Advisoryadvisory · Maven

GHSA-65rj-cgrp-g65w Jenkins IBM AppScan Plugin showed plain text password in job configuration form fields

MEDIUM Published 2022-05-24 Modified 2024-01-30 Official page ↗
Aliases
CVE-2019-10391
Ecosystem
Maven
Packages
com.hcl.security:ibm-application-security
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-319
Reviewed
2024-01-30

Affected packages

• Maven com.hcl.security:ibm-application-security: < 1.2.5 → fixed in 1.2.5

Description

Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure. This plugin has bee deprecated.

Related

Alias · CVE (1)

  • CVE-2019-10391 Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References