low3.3
CVE-2020-2249
Credentials stored in plain text by Jenkins tfs Plugin
Impact
tfs Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file `hudson.plugins.tfs.TeamPluginGlobalConfig.xml` on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jenkins-ci.plugins:tfs | <= 5.157.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jenkins | Team Foundation Server | through 5.157.1 |