Weakness (CWE)
CWE-256: Plaintext Storage of a Password
The product stores a password in plaintext within resources such as memory or files.
How to prevent it (3 mitigations)
-
Architecture and Design
Avoid storing passwords in easily accessible locations.
-
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
-
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
Source: MITRE CWE-256
46 results · Clear filters · Feed
-
Low 3.1
Client secret transmitted in plain text by Azure AD Plugin
Jenkins Azure AD Plugin 1.1.2 and earlier transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Low 3.3
Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file
Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low —
Plaintext Storage in Jenkins Spira Importer Plugin
Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
-
Low 3.3
DingTalk Plugin stores credentials in plain text
Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
-
Low —
Jenkins LDAP Email Plugin shows plain text password in configuration form
Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
-
Low 3.4
An issue was discovered in SMA Solar Technology products. Sniffed passwords from SMAdata2+ communication can be decrypt…