Low · 3.3 CVE-2019-10361 EUVD-2022-5446GHSA-vwx8-qpqh-qwm9

Jenkins Maven Release Plug-in Plugin stored credentials in plain text

Published Jul 31, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Maven Release Plugin Package: org.jenkins-ci.plugins.m2release:m2release Category: Web / CMS Ecosystem: Maven

Description

Jenkins Maven Release Plugin 0.14.0 and earlier stored credentials unencrypted on the Jenkins master where they could be viewed by users with access to the master file system.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Maven Release Plugin	0.14.0 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins.m2release:m2release	< 0.15.0	0.15.0	GHSA-vwx8-qpqh-qwm9

References

[oss-security] 20190731 Multiple vulnerabilities in Jenkins plugins mailing-list
https://www.zerodayinitiative.com/advisories/ZDI-19-835/
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435