[MAVEN:GHSA-9WVR-X83M-84V4] Passwords stored in plain text by Jenkins Vmware vRealize CodeStream Plugin

Severity Moderate

Affected Packages 1

CVEs 1

Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Package	Affected Version
pkg:maven/com.vmware.vcac/vmware-vrealize-codestream	<= 1.2

ID

MAVEN:GHSA-9WVR-X83M-84V4

Severity

moderate

URL

https://github.com/advisories/GHSA-9wvr-x83m-84v4

Published

2022-03-16T00:00:43
(2 years ago)

Modified

2023-02-02T05:05:06
(19 months ago)

Rights

Maven Security Team

Other Advisories

JENKINS:SECURITY-2238

Source	# ID	Name	URL
			https://nvd.nist.gov/vuln/detail/CVE-2022-27217
			https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2238
			http://www.openwall.com/lists/oss-security/2022/03/15/2
			https://github.com/advisories/GHSA-9wvr-x83m-84v4

Type	Package URL	Namespace	Name / Product	Version	Distribution / Platform	Arch	Patch / Fix
Affected	pkg:maven/com.vmware.vcac/vmware-vrealize-codestream	com.vmware.vcac	vmware-vrealize-codestream	<= 1.2

# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	Exploits	PoC	Pubblication Date	Modification Date
# CVE	Description	CVSS	EPSS	EPSS Trend (30 days)	Affected Products	Weaknesses	Security Advisories	PoC	Pubblication Date	Modification Date