GHSA-rxfv-gm5x-9wqj

Jenkin allows attackers to obtain passwords by reading the HTML source code

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-2061

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.jenkins-ci.main:jenkins-core	>= 1.533, < 1.551	1.551
Maven	org.jenkins-ci.main:jenkins-core	< 1.532.2	1.532.2

Details

As written in the advisory (Markdown source, shown as plain text).

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-2061 advisory
https://github.com/jenkinsci/jenkins/commit/bf539198564a1108b7b71a973bf7de963a6213ef web
https://github.com/jenkinsci/jenkins package
https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 web
http://www.openwall.com/lists/oss-security/2014/02/21/2 web