Jenkins Aqua MicroScanner Plugin showed plain text credential in configuration form

2022-05-2422:00:44

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.7%

JSON

Jenkins Aqua MicroScanner Plugin 1.0.7 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

CPENameOperatorVersion
org.jenkins-ci.plugins:aqua-microscannereq1.0.2
org.jenkins-ci.plugins:aqua-microscannereq1.0.7
org.jenkins-ci.plugins:aqua-microscannereq1.0.5
org.jenkins-ci.plugins:aqua-microscannereq1.0.1
org.jenkins-ci.plugins:aqua-microscannereq1.0.3
org.jenkins-ci.plugins:aqua-microscannereq1.0.6
org.jenkins-ci.plugins:aqua-microscannereq1.0.4

Name	Operator	Version
org.jenkins-ci.plugins:aqua-microscanner	eq	1.0.2
org.jenkins-ci.plugins:aqua-microscanner	eq	1.0.7
org.jenkins-ci.plugins:aqua-microscanner	eq	1.0.5
org.jenkins-ci.plugins:aqua-microscanner	eq	1.0.1
org.jenkins-ci.plugins:aqua-microscanner	eq	1.0.3
org.jenkins-ci.plugins:aqua-microscanner	eq	1.0.6
org.jenkins-ci.plugins:aqua-microscanner	eq	1.0.4