Skip to content
OpenAdvisories
Medium · 5.5 CVE-2019-10345 EUVD-2022-3955GHSA-ggmx-pq89-7mcr

Plaintext Storage of a Password in Jenkins Configuration as Code Plugin

Published Jul 31, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Configuration as Code Plugin Package: io.jenkins:configuration-as-code Category: Web / CMS Ecosystem: Maven

Description

Jenkins Configuration as Code Plugin 1.20 and earlier did not treat the proxy password as a secret to be masked when logging or encrypted for export.

Affected products

VendorProductAffectedFixed
Jenkins project Jenkins Configuration as Code Plugin 1.20 and earlier —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.jenkins:configuration-as-code < 1.25 1.25 GHSA-ggmx-pq89-7mcr

References