GitHub Advisoryadvisory · Maven
GHSA-84h6-jf8x-ff2j Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials
HIGH
Official page ↗
- Aliases
- CVE-2019-10460
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:bitbucket-oauth
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-522
- Reviewed
- 2022-12-06
Affected packages
• Maven org.jenkins-ci.plugins:bitbucket-oauth: < 0.10 → fixed in 0.10
Description
Jenkins Bitbucket OAuth Plugin prior to 0.10 stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Related
Alias · CVE (1)
- CVE-2019-10460 Jenkins Bitbucket OAuth Plugin 0.9 and earlier stored credentials unencrypted in the global config.xml configuration file on the Jenkins… vulnerability
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10460 advisory
- https://github.com/jenkinsci/bitbucket-oauth-plugin/commit/f55d222db910220ca8cd8631fb746c98b9e12870 web
- https://github.com/jenkinsci/bitbucket-oauth-plugin package
- https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1546 web
- http://www.openwall.com/lists/oss-security/2019/10/23/2 web