~ / search / GHSA-j7gw-mwfg-vqf4

GHSA-j7gw-mwfg-vqf4

Jenkins Credentials Binding Plugin Stores Passwords in a Recoverable Format

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1010241

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:credentials-binding 1.17 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Credentials Binding Plugin Jenkins 1.17 is affected by: CWE-257: Storing Passwords in a Recoverable Format. The impact is: Authenticated users can recover credentials. The component is: config-variables.jelly line #30 (passwordVariable). The attack vector is: Attacker creates and executes a Jenkins job.

References

External links from the advisory. They lead to third-party sites.