jenkinsci/fortify-plugin · Security
Fortify Plugin stored credentials in plain text
- GHSA ID
- GHSA-xr37-pjfh-qwwc
- CVE ID
- CVE-2020-2107
- Severity
- medium
- Published
- Updated
- CVSS
- 4.3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 4.3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Fortify Plugin 19.1.29 and earlier stored its proxy server password unencrypted in job config.xml files. This password could be read by users with the Extended Read permission.
Fortify Plugin 19.2.30 now encrypts the proxy server password.
CWEs
- CWE-256 · Plaintext Storage of a Password
- CWE-522 · Insufficiently Protected Credentials