jenkinsci/jenkins · Security
Jenkin allows attackers to obtain passwords by reading the HTML source code
- GHSA ID
- GHSA-rxfv-gm5x-9wqj
- CVE ID
- CVE-2014-2061
- Severity
- medium
- Published
- Updated
Description
The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-2061 ↗
- https://github.com/jenkinsci/jenkins/commit/bf539198564a1108b7b71a973bf7de963a6213ef ↗
- https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2014-02-14 ↗
- http://www.openwall.com/lists/oss-security/2014/02/21/2 ↗
- https://github.com/advisories/GHSA-rxfv-gm5x-9wqj ↗