Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted

2022-07-2800:00:42

Google

osv.dev

0.001 Low

EPSS

Percentile

27.8%

JSON

HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file jenkins.plugins.http_request.HttpRequest.xml on the Jenkins controller as part of its configuration when using (deprecated) Basic/Digest Authentication. These passwords can be viewed by users with access to the Jenkins controller file system.

CPENameOperatorVersion
org.jenkins-ci.plugins:http_requesteq1.7
org.jenkins-ci.plugins:http_requesteq1.8.3
org.jenkins-ci.plugins:http_requesteq1.8.25
org.jenkins-ci.plugins:http_requesteq1.8.7
org.jenkins-ci.plugins:http_requesteq1.8.23
org.jenkins-ci.plugins:http_requesteq1.3
org.jenkins-ci.plugins:http_requesteq1.1
org.jenkins-ci.plugins:http_requesteq1.11
org.jenkins-ci.plugins:http_requesteq1.8.11
org.jenkins-ci.plugins:http_requesteq1.8.17

Name	Operator	Version
org.jenkins-ci.plugins:http_request	eq	1.7
org.jenkins-ci.plugins:http_request	eq	1.8.3
org.jenkins-ci.plugins:http_request	eq	1.8.25
org.jenkins-ci.plugins:http_request	eq	1.8.7
org.jenkins-ci.plugins:http_request	eq	1.8.23
org.jenkins-ci.plugins:http_request	eq	1.3
org.jenkins-ci.plugins:http_request	eq	1.1
org.jenkins-ci.plugins:http_request	eq	1.11
org.jenkins-ci.plugins:http_request	eq	1.8.11
org.jenkins-ci.plugins:http_request	eq	1.8.17