Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1wOXJjLXg0OGYtNTgyeM4AAl8t
Passwords stored in plain text by ElasTest Plugin
Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Permalink: https://github.com/advisories/GHSA-p9rc-x48f-582xJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wOXJjLXg0OGYtNTgyeM4AAl8t
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 6 months ago
CVSS Score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Identifiers: GHSA-p9rc-x48f-582x, CVE-2020-2274
References:
- https://nvd.nist.gov/vuln/detail/CVE-2020-2274
- https://www.jenkins.io/security/advisory/2020-09-16/#SECURITY-2014
- http://www.openwall.com/lists/oss-security/2020/09/16/3
- https://github.com/advisories/GHSA-p9rc-x48f-582x
Affected Packages
maven:org.jenkins-ci.plugins:elastest
Affected Version Ranges: <= 1.2.1No known fixed version