GitHub Advisoryadvisory · Maven
GHSA-6fv3-w7j6-5xfc Jenkins Sonar Gerrit Plugin stores credentials unencrypted
MEDIUM
Official page ↗
- Aliases
- CVE-2019-10467
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:sonar-gerrit
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-522
- Reviewed
- 2022-12-06
Affected packages
• Maven org.jenkins-ci.plugins:sonar-gerrit: < 2.4.5 → fixed in 2.4.5
Description
Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Related
Alias · CVE (1)
- CVE-2019-10467 Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users… vulnerability
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10467 advisory
- https://github.com/jenkinsci/sonar-gerrit-plugin/commit/d86de84131660051de7a90195478761b7d087630 web
- https://github.com/jenkinsci/sonar-gerrit-plugin package
- https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1003 web
- http://www.openwall.com/lists/oss-security/2019/10/23/2 web