medium5.5
CVE-2019-10361
Jenkins Maven Release Plug-in Plugin stored credentials in plain text
Impact
Jenkins Maven Release Plug-in Plugin stored credentials unencrypted in its global configuration file `org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper.xml` on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Maven Release Plug-in Plugin now stores credentials encrypted.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins.m2release:m2release | <= 0.14.0 | 0.15.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | M2release | through 0.14.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2019/07/31/1
- https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1435
- https://www.zerodayinitiative.com/advisories/ZDI-19-835/
- https://github.com/advisories/GHSA-vwx8-qpqh-qwm9
- https://nvd.nist.gov/vuln/detail/CVE-2019-10361
- https://github.com/jenkinsci/m2release-plugin/commit/a2e7f2bb82640a9d3641265a19c86ba141a7e79c