~ / search / GHSA-cwxx-gwwj-pqjq

GHSA-cwxx-gwwj-pqjq

Jenkins Perforce Plugin uses ineffective credentials encryption

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000145

Packages

EcosystemPackageAffectedFixed in
Maven org.jvnet.hudson.plugins:perforce <= 1.3.36 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them.

References

External links from the advisory. They lead to third-party sites.