Jenkins aws-device-farm Plugin stores credentials in plain text

2022-05-1301:17:44

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%

JSON

Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.awsdevicefarm.AWSDeviceFarmRecorder.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.

CPENameOperatorVersion
org.jenkins-ci.plugins:aws-device-farmeq1.5
org.jenkins-ci.plugins:aws-device-farmeq1.20
org.jenkins-ci.plugins:aws-device-farmeq1.23
org.jenkins-ci.plugins:aws-device-farmeq1.22
org.jenkins-ci.plugins:aws-device-farmeq1.3
org.jenkins-ci.plugins:aws-device-farmeq1.15
org.jenkins-ci.plugins:aws-device-farmeq1.13
org.jenkins-ci.plugins:aws-device-farmeq1.24
org.jenkins-ci.plugins:aws-device-farmeq1.21
org.jenkins-ci.plugins:aws-device-farmeq1.17

Name	Operator	Version
org.jenkins-ci.plugins:aws-device-farm	eq	1.5
org.jenkins-ci.plugins:aws-device-farm	eq	1.20
org.jenkins-ci.plugins:aws-device-farm	eq	1.23
org.jenkins-ci.plugins:aws-device-farm	eq	1.22
org.jenkins-ci.plugins:aws-device-farm	eq	1.3
org.jenkins-ci.plugins:aws-device-farm	eq	1.15
org.jenkins-ci.plugins:aws-device-farm	eq	1.13
org.jenkins-ci.plugins:aws-device-farm	eq	1.24
org.jenkins-ci.plugins:aws-device-farm	eq	1.21
org.jenkins-ci.plugins:aws-device-farm	eq	1.17