~ / search / GHSA-c7p6-x2p3-3wph

GHSA-c7p6-x2p3-3wph

Jenkins youtrack-plugin Plugin stored credentials in plain text

Source: GitHub Advisory Database (reviewed) Low CVE-2019-10287

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:youtrack-plugin < 0.7.2 0.7.2

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins youtrack-plugin Plugin stored credentials unencrypted in its global configuration file `org.jenkinsci.plugins.youtrack.YouTrackProjectProperty.xml` on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. youtrack-plugin Plugin now stores credentials encrypted.

References

External links from the advisory. They lead to third-party sites.