GitHub Advisoryadvisory · Maven

GHSA-6hw7-x86v-wrgf Passwords stored in plain text by Jenkins view-cloner Plugin

MEDIUM Published 2023-01-26 Modified 2023-02-02 Official page ↗
Aliases
CVE-2023-24450
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:view-cloner
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-256, CWE-312
Reviewed
2023-01-27

Affected packages

• Maven org.jenkins-ci.plugins:view-cloner: <= 1.1 (no fix yet)

Description

Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2023-24450 Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References