PT-2019-11870 · Jenkins · Jenkins Zulip Plugin+1
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Jenkins Zulip Plugin versions 1.1.0 and earlier
Jenkins Zulip Plugin versions prior to 1.1.1
Description
The issue allows stored credentials to be viewed unencrypted in the global configuration file on the Jenkins master. This could be accessed by users with access to the master file system.
Recommendations
For Jenkins Zulip Plugin versions 1.1.0 and earlier, update to version 1.1.1 or later to resolve the issue.
For Jenkins Zulip Plugin versions prior to 1.1.1, update to version 1.1.1 or later to resolve the issue.
Fix
Insufficiently Protected Credentials
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Jenkins
Jenkins Zulip Plugin