High · 7.5 CVE-2019-10428 EUVD-2022-5832GHSA-xp44-8vwr-xwmv

Jenkins Aqua Security Scanner Plugin showed plain text password in configuration form

Published Sep 25, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Aqua Security Scanner Plugin Package: org.jenkins-ci.plugins:aqua-security-scanner Category: Web / CMS Ecosystem: Maven

Description

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins Aqua Security Scanner Plugin	3.0.17 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jenkins-ci.plugins:aqua-security-scanner	< 3.0.18	3.0.18	GHSA-xp44-8vwr-xwmv

References

https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1508
[oss-security] 20190925 Multiple vulnerabilities in Jenkins and Jenkins plugins mailing-list