GitHub Advisoryadvisory · Maven

GHSA-jcwj-j574-8j2c Jenkins Azure AD Plugin stored the client secret unencrypted

LOW Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10318
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:azure-ad
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2023-10-26

Affected packages

• Maven org.jenkins-ci.plugins:azure-ad: < 0.3.4 → fixed in 0.3.4

Description

Jenkins Azure AD Plugin stored the client secret unencrypted in the global config.xml configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Azure AD Plugin now stores the client secret encrypted.

Related

Alias · CVE (1)

  • CVE-2019-10318 Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References