Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1qcm1mLXhocjYtMzQyOM4AAiOG

Jenkins SourceGear Vault plugin transmits credentials in plain text

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. As of the publication of the advisory, there are no patches and the plugin is unmaintained.

Permalink: https://github.com/advisories/GHSA-jrmf-xhr6-3428
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1qcm1mLXhocjYtMzQyOM4AAiOG
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: over 1 year ago


CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-jrmf-xhr6-3428, CVE-2019-10435
References: Blast Radius: 1.0

Affected Packages

maven:org.jenkins-ci.plugins:vault-scm-plugin
Affected Version Ranges: <= 1.1.1
No known fixed version