Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS05aDc5LTVtMmYtbXFqMs4AAs7y
Squash TM Publisher (Squash4Jenkins) Plugin stores passwords stored in plain text
Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file org.jenkinsci.squashtm.core.SquashTMPublisher.xml on the Jenkins controller as part of its configuration.
These passwords can be viewed by users with access to the Jenkins controller file system.
Permalink: https://github.com/advisories/GHSA-9h79-5m2f-mqj2JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05aDc5LTVtMmYtbXFqMs4AAs7y
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 2 years ago
Updated: about 1 year ago
CVSS Score: 3.3
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Identifiers: GHSA-9h79-5m2f-mqj2, CVE-2022-34213
References:
- https://nvd.nist.gov/vuln/detail/CVE-2022-34213
- https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2089
- https://github.com/advisories/GHSA-9h79-5m2f-mqj2
Affected Packages
maven:org.jenkins-ci.plugins:squashtm-publisher
Affected Version Ranges: <= 1.0.0No known fixed version