Jenkins Artifactory Plugin 3.6.0 and earlier stores Artifactory server passwords in its global configuration file org.jfrog.hudson.ArtifactoryBuilder.xml on the Jenkins controller as part of its configuration.
While the password is stored encrypted on …
[io.jenkins.plugins:cryptomove] OS command injection in CryptoMove Plugin
CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Co…
[org.jenkins-ci.plugins:literate] Remote Code Execution vulnerability in Jenkins Literate Plugin
Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-2158
https://jenkins.i…
[org.jenkins-ci.plugins:skytap] Credentials transmitted in plain text by Skytap Cloud CI Plugin
Skytap Cloud CI Plugin stores credentials in job config.xml files as part of its configuration.
While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin 2.07 and …
[fr.edf.jenkins.plugins:mac] Missing SSH host key validation in Mac Plugin
Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.
Mac Plu…
[fr.edf.jenkins.plugins:mac] Missing permission checks in Mac Plugin
A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
References
https://nvd.nist.gov/vuln/detail/CVE-2020-…
[org.jenkins-ci.plugins:backlog] Credentials transmitted in plain text by Backlog Plugin
Backlog Plugin stores credentials in job config.xml files as part of its configuration.
While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Backlog Plugin 2.4 and earlier. These cr…
[org.jenkins-ci.plugins:openshift-deployer] Credentials transmitted in plain text by OpenShift Deployer Plugin
OpenShift Deployer Plugin stores credentials in its global configuration file org.jenkinsci.plugins.openshift.DeployApplication.xml on the Jenkins controller as part of its configuration.
While the credentials are stored encrypted on disk, they are tra…
[org.jenkins-ci.plugins:zephyr-for-jira-test-management] Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text
Zephyr for JIRA Test Management Plugin 1.5 and earlier stores Jira credentials unencrypted in its global configuration file com.thed.zephyr.jenkins.reporter.ZfjReporter.xml on the Jenkins controller. These credentials can be viewed by users with access…
[org.jvnet.hudson.plugins:svn-release-mgr] Jenkins Subversion Release Manager Plugin vulnerable to cross-site scripting (XSS)
Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation. This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site s…