GHSA-xcp5-j5fj-3xp6

ghsaUSosv

User passwords stored in plain text by Jenkins EasyQA Plugin

view advisory published 2022-06-24Licence: CC-BY-4.0

EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file `EasyQAPluginProperties.xml` on the Jenkins controller as part of its configuration. These passwords can be viewed by users with access to the Jenkins controller file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-34202US	medium6.5	0.72% (54th)	—	2022-06-23
Jenkins EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/easyqa-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2022-34202ADVISORY
https://www.jenkins.io/security/advisory/2022-06-22/#SECURITY-2066WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan