PT-2019-12251 · Cloudbees · Cloudbees Jenkins Operations Center

Binary1985 + 1 · Publicado 2019-04-19 · Atualizado 2020-08-24 · CVE-2019-11350

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudBees Jenkins Operations Center version 2.150.2.3

Description The issue allows cleartext password storage and retrieval via the proxy configuration page when an expired trial license exists.

Recommendations For CloudBees Jenkins Operations Center version 2.150.2.3, consider removing or updating the expired trial license to prevent cleartext password storage and retrieval. As a temporary workaround, restrict access to the proxy configuration page to minimize the risk of exploitation.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2019-11350

Produtos afetados

Cloudbees Jenkins Operations Center

Referências · 5

• https://github.com/binary1985/VulnerabilityDisclosure/blob/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure · Nota
• https://osv.dev/vulnerability/CVE-2019-11350 · Aviso do Fabricante
• https://release-notes.cloudbees.com/release/21/8.18 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-11350 · Nota de Segurança
• https://raw.githubusercontent.com/binary1985/VulnerabilityDisclosure/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure · Nota