Low · 3.3 CVE-2019-10296 EUVD-2022-5246GHSA-rwrx-hrf2-v577

Jenkins Serena SRA Deploy Plugin stores credentials in plain text

Published Apr 4, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Serena SRA Deploy Plugin Package: com.urbancode.ds.jenkins.plugins:sra-deploy Category: Web / CMS Ecosystem: Maven

Description

Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Serena SRA Deploy Plugin	all versions as of 2019-04-03	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.urbancode.ds.jenkins.plugins:sra-deploy	<= 1.4.2.4	—	GHSA-rwrx-hrf2-v577

References

107790 vdb-entry
[oss-security] 20190413 Re: Multiple vulnerabilities in Jenkins plugins mailing-list
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1066