GitHub Advisoryadvisory · Maven

GHSA-j4ph-wp3c-c37w Jenkins FitNesse Plugin stores passwords unencrypted

MEDIUM Published 2026-06-24 Modified 2026-09-25 Official page ↗
Aliases
CVE-2026-57302
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:fitnesse
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-256
Reviewed
2026-09-25

Affected packages

• Maven org.jenkins-ci.plugins:fitnesse: <= 1.36 (no fix yet)

Description

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2026-57302 Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be… vulnerability

Weakness · CWE (1)

  • CWE-256 Plaintext Storage of a Password weakness

References