GHSA-6hw7-x86v-wrgf

ghsaUSosv

Passwords stored in plain text by Jenkins view-cloner Plugin

view advisory published 2023-01-26Licence: CC-BY-4.0

Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-24450US	medium6.5OT elevated	0.60% (49th)	—	2023-01-26
Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permi…

references

External citations — patches, advisories, analysis.

https://github.com/jenkinsci/view-cloner-pluginPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2023-24450ADVISORY
https://www.jenkins.io/security/advisory/2023-01-24/#SECURITY-2787WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan