Jenkins Subversion Plugin Stores Credentials with Base64 Encoding
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.credentials file.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-6372US | low2.1 | — | ||
The Subversion plugin before 1.54 for Jenkins stores credentials using base64 encoding, which allows local users to obtain passwords and SSH private keys by reading a subversion.cr… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHBA-2014:1630WEB
- https://access.redhat.com/security/cve/CVE-2013-6372WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1032391WEB
- https://github.com/jenkinsci/subversion-pluginPACKAGE
- https://github.com/jenkinsci/subversion-plugin/commit/7d4562d6f7e40de04bbe29577b51c79f07d05ba6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2013-6372ADVISORY
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-11-20WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan