GHSA-53jw-4gwh-m8cm

Jenkins LDAP Email Plugin shows plain text password in configuration form

Source: GitHub Advisory Database (reviewed) Low CVE-2019-10434

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.mtvi.plateng.hudson:ldapemail	<= 0.8	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10434 advisory
https://github.com/jenkinsci/ldapemail-plugin package
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515 web
http://www.openwall.com/lists/oss-security/2019/10/01/2 web