Jenkins Maven Release Plug-in Plugin stored credentials in plain text

2022-05-2416:51:51

Google

osv.dev

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

28.6%

JSON

Jenkins Maven Release Plug-in Plugin stored credentials unencrypted in its global configuration file org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

Maven Release Plug-in Plugin now stores credentials encrypted.

CPENameOperatorVersion
org.jenkins-ci.plugins.m2release:m2releaseeq0.14.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.11.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.12.0
org.jenkins-ci.plugins.m2release:m2releaseeq0.13.0

Name	Operator	Version
org.jenkins-ci.plugins.m2release:m2release	eq	0.14.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.11.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.12.0
org.jenkins-ci.plugins.m2release:m2release	eq	0.13.0