GitHub Advisoryadvisory · Maven

GHSA-rfc8-wrrf-wp3w Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text

LOW Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10303
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:azure-publishersettings-credentials
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2023-10-26

Affected packages

• Maven org.jenkins-ci.plugins:azure-publishersettings-credentials: < 1.5 → fixed in 1.5

Description

Jenkins Azure PublisherSettings Credentials Plugin stored the service management certificate unencrypted in credentials.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Azure PublisherSettings Credentials Plugin has been deprecated. Azure PublisherSettings Credentials Plugin 1.5 no longer provides any user features and we recommend the plugin be uninstalled.

Related

Alias · CVE (1)

  • CVE-2019-10303 Jenkins Azure PublisherSettings Credentials Plugin 1.2 and earlier stored credentials unencrypted in the credentials.xml file on the… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References