GitHub Advisoryadvisory · Maven

GHSA-cvh8-9j4x-5v4j Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk

HIGH Published 2022-05-13 Modified 2024-01-30 Official page ↗
Aliases
CVE-2018-1000424
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:artifactory
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2024-01-30

Affected packages

• Maven org.jenkins-ci.plugins:artifactory: < 2.16.2 → fixed in 2.16.2

Description

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.

Related

Alias · CVE (1)

  • CVE-2018-1000424 An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java,… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References