~ / search / GHSA-wmq3-24jm-m8xh

GHSA-wmq3-24jm-m8xh

Jenkins Assembla Auth Plugin stores credentials in plain text

Source: GitHub Advisory Database (reviewed) High CVE-2019-10280

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:assembla-auth < 1.13 1.13

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins Assembla Auth Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

References

External links from the advisory. They lead to third-party sites.