High · 8.8 CVE-2019-10347 EUVD-2022-3417GHSA-9p5v-6p5f-f28h

Stored credentials unencrypted in Jenkins Mashup Portlets Plugin

Published Jul 11, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Mashup Portlets Plugin Package: javagh.jenkins:mashup-portlets-plugin Category: Web / CMS Ecosystem: Maven

Description

Jenkins Mashup Portlets Plugin stored credentials unencrypted on the Jenkins master where they can be viewed by users with access to the master file system.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Mashup Portlets Plugin	1.0.9 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	javagh.jenkins:mashup-portlets-plugin	< 1.1.0	1.1.0	GHSA-9p5v-6p5f-f28h

References

[oss-security] 20190711 Multiple vulnerabilities in Jenkins plugins mailing-list
109156 vdb-entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-775