GHSA-h6pp-v4j6-w76c

ghsaUSosv

Password stored in plain text by Dynamic Extended Choice Parameter Plugin

view advisory published 2022-05-24Licence: CC-BY-4.0

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-2124US	medium4.3	0.69% (53rd)	—	2020-02-12
Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with…

references

External citations — patches, advisories, analysis.

http://www.openwall.com/lists/oss-security/2020/02/12/3WEB
https://github.com/jenkinsci/dynamic-extended-choice-parameter-pluginPACKAGE
https://jenkins.io/security/advisory/2020-02-12/#SECURITY-1560WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-2124ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan