GitHub Advisoryadvisory · Maven
GHSA-9p5v-6p5f-f28h Stored credentials unencrypted in Jenkins Mashup Portlets Plugin
HIGH
Official page ↗
- Aliases
- CVE-2019-10347
- Ecosystem
- Maven
- Packages
- javagh.jenkins:mashup-portlets-plugin
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-522
- Reviewed
- 2023-12-14
Affected packages
• Maven javagh.jenkins:mashup-portlets-plugin: < 1.1.0 → fixed in 1.1.0
Description
Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.
Related
Alias · CVE (1)
- CVE-2019-10347 Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the… vulnerability
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10347 advisory
- https://github.com/jenkinsci/mashup-portlets-plugin/commit/05eb9bfd5c758c8c477ce6bd4315fd65d83e9a0a web
- https://jenkins.io/security/advisory/2019-07-11/#SECURITY-775 web
- http://www.openwall.com/lists/oss-security/2019/07/11/4 web
- http://www.securityfocus.com/bid/109156 web