GHSA-jcwj-j574-8j2c

Jenkins Azure AD Plugin stored the client secret unencrypted

Source: GitHub Advisory Database (reviewed) Low CVE-2019-10318

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:azure-ad	< 0.3.4	0.3.4

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Azure AD Plugin stored the client secret unencrypted in the global config.xml configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Azure AD Plugin now stores the client secret encrypted.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-10318 advisory
https://github.com/jenkinsci/azure-ad-plugin/commit/70983d1a6528847ccd6e7f124450c578c42d194f web
https://jenkins.io/security/advisory/2019-04-30/#SECURITY-1390 web
https://web.archive.org/web/20200227073756/http://www.securityfocus.com/bid/108159 web
http://www.openwall.com/lists/oss-security/2019/04/30/5 web