Lucene search

GoogleOSV:GHSA-RV97-R8F7-8WMG

HistoryMay 24, 2022 - 10:00 p.m.

Plaintext password storage in Jenkins InfluxDB Plugin

2022-05-2422:00:03

Google

osv.dev

jenkins

influxdb

plugin

password storage

plaintext

credentials

unencrypted

global configuration

file system

security issue

EPSS

0.003

Percentile

66.2%

JSON

Jenkins InfluxDB Plugin Prior to 1.22 stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

References

www.openwall.com/lists/oss-security/2019/05/31/2

www.securityfocus.com/bid/108540

github.com/jenkinsci/influxdb-plugin

github.com/jenkinsci/influxdb-plugin/commit/bfc2fcc0d8e6fb6f2dff5a45353abac5cefc0573

jenkins.io/security/advisory/2019-05-31/#SECURITY-1403

nvd.nist.gov/vuln/detail/CVE-2019-10329

EPSS

0.003

Percentile

66.2%

JSON

Related for OSV:GHSA-RV97-R8F7-8WMG