Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12djZwLTYzZzgtbThmd837BQ

Jenkins Audit to Database Plugin stores credentials in plain text

Jenkins Audit to Database Plugin stores database credentials unencrypted in its global configuration file audit2db.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.

Permalink: https://github.com/advisories/GHSA-vv6p-63g8-m8fw
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12djZwLTYzZzgtbThmd837BQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 2 years ago
Updated: 6 months ago

CVSS Score: 3.3
CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Identifiers: GHSA-vv6p-63g8-m8fw, CVE-2019-1003075
References:

• https://nvd.nist.gov/vuln/detail/CVE-2019-1003075
• https://jenkins.io/security/advisory/2019-04-03/#SECURITY-966
• http://www.openwall.com/lists/oss-security/2019/04/12/2
• https://web.archive.org/web/20200227082017/http://www.securityfocus.com/bid/107790
• https://github.com/advisories/GHSA-vv6p-63g8-m8fw

Blast Radius: 1.0

Affected Packages