Описание
Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a recoverable format, allowing attackers with access to the Jenkins controller file system to recover the plain text password of that account, likely gaining administrator access to Jenkins.
Ссылки
- Mailing List
- Vendor Advisory
- Mailing List
- Vendor Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 2.6 (включая)
cpe:2.3:a:jenkins:openid:*:*:*:*:*:jenkins:*:*
EPSS
Процентиль: 1%
0.00012
Низкий
6.7 Medium
CVSS3
Дефекты
CWE-522
Связанные уязвимости
CVSS3: 6.7
github
около 2 лет назад
Password stored in a recoverable format by Jenkins OpenId Connect Authentication Plugin
EPSS
Процентиль: 1%
0.00012
Низкий
6.7 Medium
CVSS3
Дефекты
CWE-522