GHSA-cvh8-9j4x-5v4j

ghsaUSosv

Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk

view advisory published 2022-05-13Licence: CC-BY-4.0

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000424US	high7.8	0.33% (26th)	—	2019-01-09
An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attacke…

references

External citations — patches, advisories, analysis.

http://www.securityfocus.com/bid/106532WEB
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-265WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000424ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan