~ / search / GHSA-65rj-cgrp-g65w

GHSA-65rj-cgrp-g65w

Jenkins IBM AppScan Plugin showed plain text password in job configuration form fields

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-10391

Packages

EcosystemPackageAffectedFixed in
Maven com.hcl.security:ibm-application-security < 1.2.5 1.2.5

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure. This plugin has bee deprecated.

References

External links from the advisory. They lead to third-party sites.