GitHub Advisoryadvisory · Maven

GHSA-9678-5f6f-wp3f Jenkins Beaker Builder Plugin has Insufficiently Protected Credentials

LOW Published 2022-05-24 Modified 2023-03-02 Official page ↗
Aliases
CVE-2019-10398
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:beaker-builder
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2023-03-02

Affected packages

• Maven org.jenkins-ci.plugins:beaker-builder: < 1.10 → fixed in 1.10

Description

Beaker builder Plugin stored the Beaker password unencrypted on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system. Beaker builder Plugin now stores these credentials encrypted.

Related

Alias · CVE (1)

  • CVE-2019-10398 Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References