GHSA-5fq9-x9f4-x2r2
Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.jenkins-ci.plugins:zos-connector | < 2.0.0 | 2.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured password. IBM z/OS Connector Plugin 2.0.0 and newer integrates with Credentials Plugin, no longer storing credentials itself.
References
External links from the advisory. They lead to third-party sites.