CVE-2018-1000145: Exposure of Sensitive Information to an Unauthorized Actor

An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them...

PT-2018-9319

Name of the Vulnerable Software and Affected Versions Jenkins Perforce Plugin versions prior to 1.3.37 Description A sensitive information exposure issue exists, allowing attackers with insufficient permissions to obtain Perforce passwords configured in jobs. Recommendations For Jenkins Perforce...

PT-2018-9317

Name of the Vulnerable Software and Affected Versions Jenkins Perforce Plugin versions prior to 1.3.37 Description A sensitive information exposure issue exists, allowing attackers with local file system access to obtain and decrypt encrypted Perforce passwords. This is due to a vulnerability in...

CVE-2018-1000147: Exposure of Sensitive Information to an Unauthorized Actor

An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with insufficient permission to obtain Perforce passwords configured in jobs to obtain them...

Perforce Plugin uses ineffective credentials encryption

Perforce Plugin encrypts its credentials using DES and an encryption key stored in its public source code, so it only serves as basic obfuscation. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could resul...

Perforce Plugin credentials can be obtained by users with Job/Extended Read permission

Jenkins prevents users with Extended Read permission from obtaining secrets such as credentials stored in job configurations. Perforce Plugin implements its own credential encryption using DES and an encryption key stored in its public source code. This is not considered a secret by Jenkins,...