Jenkins Aqua Security Serverless Scanner Plugin showed plain text password in job configuration form fields

2022-05-2416:55:59

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.1%

JSON

Jenkins Aqua Security Serverless Scanner Plugin 1.0.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure.

CPENameOperatorVersion
org.jenkins-ci.plugins:aqua-serverlesseq1.0.1
org.jenkins-ci.plugins:aqua-serverlesseq1.0.4
org.jenkins-ci.plugins:aqua-serverlesseq1.0.2
org.jenkins-ci.plugins:aqua-serverlesseq1.0.0
org.jenkins-ci.plugins:aqua-serverlesseq1.0.3

Name	Operator	Version
org.jenkins-ci.plugins:aqua-serverless	eq	1.0.1
org.jenkins-ci.plugins:aqua-serverless	eq	1.0.4
org.jenkins-ci.plugins:aqua-serverless	eq	1.0.2
org.jenkins-ci.plugins:aqua-serverless	eq	1.0.0
org.jenkins-ci.plugins:aqua-serverless	eq	1.0.3