~ / search / GHSA-rfc8-wrrf-wp3w

GHSA-rfc8-wrrf-wp3w

Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text

Source: GitHub Advisory Database (reviewed) Low CVE-2019-10303

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:azure-publishersettings-credentials < 1.5 1.5

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Azure PublisherSettings Credentials Plugin stored the service management certificate unencrypted in credentials.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Azure PublisherSettings Credentials Plugin has been deprecated. Azure PublisherSettings Credentials Plugin 1.5 no longer provides any user features and we recommend the plugin be uninstalled.

References

External links from the advisory. They lead to third-party sites.