GitHub Advisoryadvisory · Maven

GHSA-jrmf-xhr6-3428 Jenkins SourceGear Vault plugin transmits credentials in plain text

HIGH Published 2022-05-24 Modified 2022-12-06 Official page ↗
Aliases
CVE-2019-10435
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:vault-scm-plugin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-319
Reviewed
2022-12-06

Affected packages

• Maven org.jenkins-ci.plugins:vault-scm-plugin: <= 1.1.1 (no fix yet)

Description

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. As of the publication of the advisory, there are no patches and the plugin is unmaintained.

Related

Alias · CVE (1)

  • CVE-2019-10435 Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References