GitHub Advisoryadvisory · Maven

GHSA-8x6c-375h-pm4f Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin

HIGH Published 2022-05-24 Modified 2022-11-02 Official page ↗
Aliases
CVE-2019-10448
Ecosystem
Maven
Packages
jenkins.xtc:extensivetesting
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-312, CWE-522
Reviewed
2022-11-02

Affected packages

• Maven jenkins.xtc:extensivetesting: 1.4.4b (no fix yet)

Description

Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Related

Alias · CVE (1)

  • CVE-2019-10448 Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by… vulnerability

Weakness · CWE (2)

  • CWE-312 Cleartext Storage of Sensitive Information weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References