GHSA-362p-56c9-q273

ghsaUSosv

Jenkins iceScrum Plugin stores credentials in Cleartext

view advisory published 2022-05-24Licence: CC-BY-4.0

Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10443US	high8.8OT elevated	1.63% (76th)	—	2019-10-16
Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permis…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2019/10/16/6WEB
https://github.com/jenkinsci/icescrum-pluginPACKAGE
https://jenkins.io/security/advisory/2019-10-16/#SECURITY-1436WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-10443ADVISORY
https://www.zerodayinitiative.com/advisories/ZDI-19-933WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan