Low CVE-2019-10434 EUVD-2022-2484GHSA-53jw-4gwh-m8cm

Jenkins LDAP Email Plugin shows plain text password in configuration form

Published Oct 1, 2019 · Updated Aug 4, 2024 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins LDAP Email Plugin Package: com.mtvi.plateng.hudson:ldapemail Category: Web / CMS Ecosystem: Maven

Description

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Affected products

Vendor	Product	Affected	Fixed
Jenkins project	Jenkins LDAP Email Plugin	0.8 and earlier	—

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	com.mtvi.plateng.hudson:ldapemail	<= 0.8	—	GHSA-53jw-4gwh-m8cm

References

https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515
[oss-security] 20191001 Multiple vulnerabilities in Jenkins plugins mailing-list