GHSA-8g6v-g8qc-5w7j

Token stored in plain text by DigitalOcean Plugin

Source: GitHub Advisory Database (reviewed) Low CVE-2020-2126

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.dubture.jenkins:digitalocean-plugin	< 1.2.0	1.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2126 advisory
https://github.com/jenkinsci/digitalocean-plugin/commit/ca1112c5c52a842c6340401f02f536fc07c6620a web
https://github.com/jenkinsci/digitalocean-plugin package
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1559 web
http://www.openwall.com/lists/oss-security/2020/02/12/3 web