GHSA-qh3m-c6hw-5hmv

ghsaUSosv

Jenkins Rundeck Plugin stored credentials in plain text

view advisory published 2022-05-24Licence: CC-BY-4.0

Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-16556US	medium6.5	0.85% (58th)	—	2019-12-17
Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2019/12/17/1WEB
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1636WEB
https://nvd.nist.gov/vuln/detail/CVE-2019-16556ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan