GitHub Advisoryadvisory · Maven

GHSA-p9rc-x48f-582x Passwords stored in plain text by ElasTest Plugin

MEDIUM Published 2022-05-24 Modified 2023-10-27 Official page ↗
Aliases
CVE-2020-2274
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:elastest
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-312
Reviewed
2022-12-28

Affected packages

• Maven org.jenkins-ci.plugins:elastest: <= 1.2.1 (no fix yet)

Description

Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2020-2274 Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller… vulnerability

Weakness · CWE (1)

  • CWE-312 Cleartext Storage of Sensitive Information weakness

References