Plaintext Storage of a Password in Jenkins NS-ND Integration Performance Publisher Plugin
Moderate severity
GitHub Reviewed
Published
Nov 16, 2022
to the GitHub Advisory Database
•
Updated Oct 30, 2023
Package
Affected versions
<= 4.8.0.143
Patched versions
4.8.0.146
Description
Published by the National Vulnerability Database
Nov 15, 2022
Published to the GitHub Advisory Database
Nov 16, 2022
Reviewed
Nov 21, 2022
Last updated
Oct 30, 2023
Credits
-
NotMyFault Analyst
NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job
config.xmlfiles on the Jenkins controller as part of its configuration.These passwords can be viewed by attackers with Item/Extended Read permission or access to the Jenkins controller file system.
NS-ND Integration Performance Publisher Plugin 4.8.0.146 stores passwords encrypted once job configurations are saved again.
References