GHSA-4p59-p85x-f3wx

Jenkins Delphix Plugin vulnerable to Cleartext credential storage

Source: GitHub Advisory Database (reviewed) High CVE-2019-10453

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:delphix	<= 2.0.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10453 advisory
https://github.com/jenkinsci/delphix-plugin package
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1450 web
http://www.openwall.com/lists/oss-security/2019/10/16/6 web