GHSA-hm57-4qpx-f734

Credentials transmitted in plain text by Jenkins DeployHub Plugin

Source: GitHub Advisory Database (reviewed) Low CVE-2020-2156

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.openmake:deployhub	<= 8.0.14	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

DeployHub Plugin stores credentials in job `config.xml` files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by DeployHub Plugin 8.0.14 and earlier. These credentials could be viewed by users with Extended Read permission.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2156 advisory
https://github.com/jenkinsci/deployhub-plugin package
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1511 web
http://www.openwall.com/lists/oss-security/2020/03/09/1 web