jenkinsci/crowd2-plugin · Security
Jenkins Crowd 2 Integration Plugin stored credentials in plain text
- GHSA ID
- GHSA-cg6q-gp23-vwx8
- CVE ID
- CVE-2018-1000423
- Severity
- high
- Published
- Updated
- CVSS
- 7.8 · CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7.8 · CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2.
CWEs
- CWE-522 · Insufficiently Protected Credentials