GitHub Advisoryadvisory · Maven

GHSA-qcfr-65hf-f98x Jenkins TestLink Plugin stores credentials in plain text

LOW Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10378
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:testlink
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2023-10-26

Affected packages

• Maven org.jenkins-ci.plugins:testlink: <= 3.16 (no fix yet)

Description

Jenkins TestLink Plugin stores credentials unencrypted in its global configuration file hudson.plugins.testlink.TestLinkBuilder.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2019-10378 Jenkins TestLink Plugin 3.16 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References