Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS02aHc3LXg4NnYtd3JnZs4AAxJp
Passwords stored in plain text by Jenkins view-cloner Plugin
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Permalink: https://github.com/advisories/GHSA-6hw7-x86v-wrgfJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02aHc3LXg4NnYtd3JnZs4AAxJp
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: almost 2 years ago
CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Percentage: 0.00065
EPSS Percentile: 0.29549
Identifiers: GHSA-6hw7-x86v-wrgf, CVE-2023-24450
References:
- https://nvd.nist.gov/vuln/detail/CVE-2023-24450
- https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787
- https://github.com/advisories/GHSA-6hw7-x86v-wrgf
Affected Packages
maven:org.jenkins-ci.plugins:view-cloner
Affected Version Ranges: <= 1.1No known fixed version