~ / search / GHSA-9h79-5m2f-mqj2

GHSA-9h79-5m2f-mqj2

Squash TM Publisher (Squash4Jenkins) Plugin stores passwords stored in plain text

Source: GitHub Advisory Database (reviewed) Low CVE-2022-34213

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:squashtm-publisher <= 1.0.0 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file `org.jenkinsci.squashtm.core.SquashTMPublisher.xml` on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the Jenkins controller file system.

References

External links from the advisory. They lead to third-party sites.