GHSA-j8c7-fm85-6jj6

Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j8c7-fm85-6jj6/GHSA-j8c7-fm85-6jj6.json

Aliases

• CVE-2019-10422

Published

2022-05-24T16:56:46Z

Modified

2023-03-18T05:55:43.712226Z

Details

Call Remote Job Plugin stores a password unencrypted in job config.xml files on the Jenkins controller. This password can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

References

• https://nvd.nist.gov/vuln/detail/CVE-2019-10422
• https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1548
• http://www.openwall.com/lists/oss-security/2019/09/25/3