GitHub Advisoryadvisory · Maven

GHSA-g29v-5pwh-wxx4 Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin

MEDIUM Published 2023-01-26 Modified 2023-02-06 Official page ↗
Aliases
CVE-2023-24439
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:jira-steps
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-256, CWE-312
Reviewed
2023-01-27

Affected packages

• Maven org.jenkins-ci.plugins:jira-steps: <= 2.0.165.v8846cf59f3db (no fix yet)

Description

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2023-24439 Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file… vulnerability

Weakness · CWE (2)

  • CWE-256 Plaintext Storage of a Password weakness
  • CWE-312 Cleartext Storage of Sensitive Information weakness

References