Jenkins IBM AppScan Plugin showed plain text password in job configuration form fields

2022-05-2416:55:01

Google

osv.dev

jenkins

ibm appscan

plain text password

job configuration

security plugin

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

53.4%

JSON

Jenkins IBM Application Security on Cloud Plugin 1.2.4 and earlier transmitted configured passwords in plain text as part of job configuration forms, potentially resulting in their exposure. This plugin has bee deprecated.

References

www.openwall.com/lists/oss-security/2019/08/28/4

jenkins.io/security/advisory/2019-08-28/#SECURITY-1512

nvd.nist.gov/vuln/detail/CVE-2019-10391