GitHub Advisoryadvisory · Maven

GHSA-chm8-wp3h-f4m3 Jenkins jira-ext Plugin stores credentials unencrypted

HIGH Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10302
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:jira-ext
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-256, CWE-522
Reviewed
2023-05-19

Affected packages

• Maven org.jenkins-ci.plugins:jira-ext: < 0.9 → fixed in 0.9

Description

Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file `hudson.plugins.jira.JiraProjectProperty.xml` on the Jenkins master. These credentials could be viewed by users with access to the Jenkins master file system. jira-ext Plugin version 0.9 stores credentials encrypted.

Related

Alias · CVE (1)

  • CVE-2019-10302 Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References