Veracode Vulnerability DatabaseVERACODE:44689Cleartext Storage Of Sensitive Information
6.7 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.9 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%
oic-auth is vulnerable to Cleartext Storage of Sensitive Information. The vulnerability is due to a password of a local user account stored in plain text. This password is used as an anti-lockout feature. An attacker with access to jenkins controller file system can recover this password and likely gain admin access.
| CPE | Name | Operator | Version |
|---|---|---|---|
| openid connect authentication plugin | le | 2.6 | |
| openid connect authentication plugin | le | 2.6 |
Related
6.7 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
6.9 Medium
AI Score
Confidence
Low
0.0004 Low
EPSS
Percentile
5.1%