GitHub Advisoryadvisory · Maven

GHSA-w97x-j6rg-55v5 Password stored in plain text by Jenkins Proxmox Plugin

MEDIUM Published 2022-03-30 Modified 2023-10-27 Official page ↗
Aliases
CVE-2022-28141
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:proxmox
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-522
Reviewed
2022-11-29

Affected packages

• Maven org.jenkins-ci.plugins:proxmox: < 0.6.0 → fixed in 0.6.0

Description

Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

Related

Alias · CVE (1)

  • CVE-2022-28141 Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References