jenkinsci/easyqa-plugin · Security
User passwords stored in plain text by Jenkins EasyQA Plugin
- GHSA ID
- GHSA-xcp5-j5fj-3xp6
- CVE ID
- CVE-2022-34202
- Severity
- low
- Published
- Updated
- CVSS
- 3.3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 3.3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file EasyQAPluginProperties.xml on the Jenkins controller as part of its configuration.
These passwords can be viewed by users with access to the Jenkins controller file system.
CWEs
- CWE-256 · Plaintext Storage of a Password