GHSA-c8mf-mc3f-2wvc

ghsaUSosv

Plaintext Storage of a Password in Jenkins Convertigo Mobile Platform Plugin

view advisory published 2022-06-24Licence: CC-BY-4.0

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job `config.xml` files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-34199US	medium6.5	0.70% (53rd)	—	2022-06-23
Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Exte…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/convertigo-mobile-platform-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-34199ADVISORY
https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2064WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan