GHSA-cg6q-gp23-vwx8

Jenkins Crowd 2 Integration Plugin stored credentials in plain text

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000423

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:crowd2	< 2.0.1	2.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000423 advisory
https://github.com/jenkinsci/crowd2-plugin/commit/580be2a0dfb38d494420901f03555092b885a85f web
https://github.com/jenkinsci/crowd2-plugin web
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-1068 web
http://www.securityfocus.com/bid/106532 web