GitHub Advisoryadvisory · Maven

GHSA-x2cx-h7w4-q6x7 Jenkins Twitter Plugin stores credentials in plain text

LOW Published 2022-05-24 Modified 2023-10-26 Official page ↗
Aliases
CVE-2019-10313
Ecosystem
Maven
Packages
org.jenkins-ci.plugins:twitter
Severity
Low
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-522
Reviewed
2023-10-26

Affected packages

• Maven org.jenkins-ci.plugins:twitter: <= 0.7 (no fix yet)

Description

Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

Related

Alias · CVE (1)

  • CVE-2019-10313 Jenkins Twitter Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References