GHSA-9678-5f6f-wp3f

ghsaUSosv

Jenkins Beaker Builder Plugin has Insufficiently Protected Credentials

view advisory published 2022-05-24Licence: CC-BY-4.0

Beaker builder Plugin stored the Beaker password unencrypted on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system. Beaker builder Plugin now stores these credentials encrypted.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10398US	medium5.5	0.29% (22nd)	—	2019-09-12
Jenkins Beaker Builder Plugin 1.9 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2019/09/12/2WEB
https://github.com/jenkinsci/beaker-builder-plugin/commit/be0101f3541a5d2c28cf226c8b2e55cd4cfc94daWEB
https://jenkins.io/security/advisory/2019-09-12/#SECURITY-1545WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-10398ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan