GitHub Advisoryadvisory · Maven

GHSA-rxph-cq38-gm3g Jenkins SCTMExecutor Plugin stores credentials in plain text

MEDIUM Published 2022-05-24 Modified 2024-01-30 Official page ↗
Aliases
CVE-2019-16568
Ecosystem
Maven
Packages
hudson.plugins.sctmexecutor:SCTMExecutor
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-319
Reviewed
2024-01-30

Affected packages

• Maven hudson.plugins.sctmexecutor:SCTMExecutor: <= 2.2 (no fix yet)

Description

Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.

Related

Alias · CVE (1)

  • CVE-2019-16568 Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global… vulnerability

Weakness · CWE (1)

  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References