~ / search / GHSA-xjrr-5jpv-v6mw

GHSA-xjrr-5jpv-v6mw

Jenkins CloudFormation Plugin stores credentials in plain text

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-1003061

Packages

EcosystemPackageAffectedFixed in
Maven org.jenkins-ci.plugins:jenkins-cloudformation-plugin <= 1.2 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Jenkins CloudFormation Plugin stores credentials unencrypted in job `config.xml` files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. A fix was released for this issue https://github.com/jenkinsci/jenkins-cloudformation-plugin/commit/d492eccee09e9a9202648bd24440814d3226b0f5.

References

External links from the advisory. They lead to third-party sites.