Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS04eDZjLTM3NWgtcG00Zs4AAiYr
Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin
Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Permalink: https://github.com/advisories/GHSA-8x6c-375h-pm4fJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS04eDZjLTM3NWgtcG00Zs4AAiYr
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: over 2 years ago
Updated: about 1 year ago
CVSS Score: 8.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Percentage: 0.00104
EPSS Percentile: 0.43541
Identifiers: GHSA-8x6c-375h-pm4f, CVE-2019-10448
References:
- https://nvd.nist.gov/vuln/detail/CVE-2019-10448
- https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1432
- https://github.com/advisories/GHSA-8x6c-375h-pm4f
Affected Packages
maven:jenkins.xtc:extensivetesting
Affected Version Ranges: = 1.4.4bNo known fixed version