Low · 3.3 CVE-2019-1003071 EUVD-2022-5122GHSA-r798-qx7r-v3gw

Jenkins Octopus Deploy Plugin stores credentials in plain text

Published Apr 4, 2019 · Updated Aug 5, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins OctopusDeploy Plugin Package: hudson.plugins.octopusdeploy:octopusdeploy Category: Web / CMS Ecosystem: Maven

Description

Jenkins OctopusDeploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins OctopusDeploy Plugin	all versions as of 2019-04-03	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	hudson.plugins.octopusdeploy:octopusdeploy	< 1.9.0	1.9.0	GHSA-r798-qx7r-v3gw

References

107790 vdb-entry
[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins mailing-list
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-957