GHSA-9p5v-6p5f-f28h

Stored credentials unencrypted in Jenkins Mashup Portlets Plugin

Source: GitHub Advisory Database (reviewed) High CVE-2019-10347

Packages

Ecosystem	Package	Affected	Fixed in
Maven	javagh.jenkins:mashup-portlets-plugin	< 1.1.0	1.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10347 advisory
https://github.com/jenkinsci/mashup-portlets-plugin/commit/05eb9bfd5c758c8c477ce6bd4315fd65d83e9a0a web
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-775 web
http://www.openwall.com/lists/oss-security/2019/07/11/4 web
http://www.securityfocus.com/bid/109156 web