jenkinsci/zap-plugin · Security
Jenkins OWASP ZAP Plugin stores unencrypted credentials
- GHSA ID
- GHSA-7jx8-244g-jfpx
- CVE ID
- CVE-2019-1003060
- Severity
- low
- Published
- Updated
- CVSS
- 3.3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 3.3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Description
Jenkins Official OWASP ZAP Plugin stores Jira credentials unencrypted in its global configuration file org.jenkinsci.plugins.zap.ZAPBuilder.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.
CWEs
- CWE-311 · Missing Encryption of Sensitive Data
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-1003060 ↗
- https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1041 ↗
- http://www.openwall.com/lists/oss-security/2019/04/12/2 ↗
- https://web.archive.org/web/20200227082017/http://www.securityfocus.com/bid/107790 ↗
- https://github.com/advisories/GHSA-7jx8-244g-jfpx ↗