1. Home
  2. Security Advisories
  3. Jenkins
  4. JENKINS:SECURITY-2073

[JENKINS:SECURITY-2073] Password stored in plain text by `elasticsearch-query`

Severity Low
Affected Packages 2
CVEs 1
Info Packages References Vulnerabilities

elasticsearch-query 1.2 and earlier stores a password unencrypted in its global configuration file org.jenkinsci.plugins.elasticsearchquery.ElasticsearchQueryBuilder.xml on the Jenkins controller as part of its configuration.

This password can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.

Package Affected Version
pkg:maven/org.jenkins-ci.plugins/elasticsearch-query <= 1.2
pkg:github/jenkinsci/elasticsearch-query-plugin <= 1.2
ID
JENKINS:SECURITY-2073
Severity
low
Published
2022-06-30T00:00:00
(2 years ago)
Modified
2022-06-30T00:00:00
(2 years ago)
Rights
Jenkins Security Team
Other Advisories
Source # ID Name URL
Plugin repository elasticsearch-query repository https://github.com/jenkinsci/elasticsearch-query-plugin
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.jenkins-ci.plugins/elasticsearch-query org.jenkins-ci.plugins elasticsearch-query <= 1.2
Affected pkg:github/jenkinsci/elasticsearch-query-plugin jenkinsci elasticsearch-query-plugin <= 1.2
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date