GHSA-7h99-vjmf-5pg8
Suggest an improvement- Source
- https://github.com/advisories/GHSA-7h99-vjmf-5pg8
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-7h99-vjmf-5pg8/GHSA-7h99-vjmf-5pg8.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-7h99-vjmf-5pg8
- Aliases
-
- CVE-2019-1003068
- Published
- 2022-05-13T01:17:44Z
- Modified
- 2024-02-16T08:11:06.941553Z
- Severity
-
- 4.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- Jenkins VMware vRealize Automation Plugin Missing Encryption of Sensitive Data
- Details
-
Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job
config.xmlfiles on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system. - Database specific
{ "nvd_published_at": "2019-04-04T16:29:00Z", "cwe_ids": [ "CWE-311" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-10-26T13:02:25Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2019-1003068
- https://github.com/jenkinsci/vmware-vrealize-automation-plugin
- https://jenkins.io/security/advisory/2019-04-03/#SECURITY-945
- https://web.archive.org/web/20200227082017/http://www.securityfocus.com/bid/107790
- http://www.openwall.com/lists/oss-security/2019/04/12/2
Affected packages
Maven / com.inkysea.vmware.vra:vmware-vrealize-automation-plugin
Package
- Name
- com.inkysea.vmware.vra:vmware-vrealize-automation-plugin
- View open source insights on deps.dev
- Purl
- pkg:maven/com.inkysea.vmware.vra/vmware-vrealize-automation-plugin