PT-2017-10817 · Jenkins · Credentials Plugin+2

Jesse Glick · Publicado 2017-10-04 · Atualizado 2022-05-14 · CVE-2017-1000113

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Deploy to container Plugin (affected versions not specified)

Description The issue concerns the storage of passwords in the Deploy to container Plugin. Previously, passwords were stored unencrypted as part of the plugin's configuration, allowing users with local file system access to the Jenkins master or Extended Read access to the jobs to retrieve these passwords. The plugin now integrates with the Credentials Plugin to securely store passwords and automatically migrates existing passwords.

Recommendations For the Deploy to container Plugin, update the plugin to integrate with the Credentials Plugin to securely store passwords.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-1000113

GHSA-3Q6P-R6RR-266X

Produtos afetados

Credentials Plugin

Deploy To Container Plugin

Jenkins

Referências · 4

• https://osv.dev/vulnerability/GHSA-3q6p-r6rr-266x · Aviso do Fabricante
• https://jenkins.io/security/advisory/2017-08-07 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000113 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000113 · Nota de Segurança