GHSA-p68c-xg89-2g5r

Credentials transmitted in plain text by Backlog Plugin

Source: GitHub Advisory Database (reviewed) Low CVE-2020-2153

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.plugins:backlog	< 2.5	2.5

Details

As written in the advisory (Markdown source, shown as plain text).

Backlog Plugin stores credentials in job `config.xml` files as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Backlog Plugin 2.4 and earlier. These credentials could be viewed by users with Extended Read permission.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-2153 advisory
https://github.com/jenkinsci/backlog-plugin/commit/43f513380226831ed914c85e1bfff1cda296bbf7 web
https://github.com/jenkinsci/backlog-plugin package
https://jenkins.io/security/advisory/2020-03-09/#SECURITY-1510 web
http://www.openwall.com/lists/oss-security/2020/03/09/1 web