GitHub Advisoryadvisory · Maven
GHSA-hfjr-m75m-wmh7 Jenkins Zulip Plugin vulnerable to Insufficiently Protected Credentials
HIGH
Official page ↗
- Aliases
- CVE-2019-10476
- Ecosystem
- Maven
- Packages
- org.jenkins-ci.plugins:zulip
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-522
- Reviewed
- 2022-12-06
Affected packages
• Maven org.jenkins-ci.plugins:zulip: < 1.1.1 → fixed in 1.1.1
Description
Jenkins Zulip Plugin prior to 1.1.1 stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Related
Alias · CVE (1)
- CVE-2019-10476 Jenkins Zulip Plugin 1.1.0 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they… vulnerability
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-10476 advisory
- https://github.com/jenkinsci/zulip-plugin/commit/2a9dd6c41c2d913b0414d015b3118e3ddb60bd90 web
- https://github.com/jenkinsci/zulip-plugin package
- https://github.com/jenkinsci/zulip-plugin/releases/tag/1.1.1 web
- https://jenkins.io/security/advisory/2019-10-23/#SECURITY-1621 web
- http://www.openwall.com/lists/oss-security/2019/10/23/2 web