Jenkins Perfecto Mobile Plugin stores credentials in plain text

2022-05-1301:17:42

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.1%

JSON

Jenkins Perfecto Mobile Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

CPENameOperatorVersion
org.jenkins-ci.plugins:perfectomobileeq2.62.0.3
org.jenkins-ci.plugins:perfectomobileeq2.41.0.1
org.jenkins-ci.plugins:perfectomobileeq2.20.0.32
org.jenkins-ci.plugins:perfectomobileeq2.20.0.11
org.jenkins-ci.plugins:perfectomobileeq2.20.0.33
org.jenkins-ci.plugins:perfectomobileeq2.20.1.2
org.jenkins-ci.plugins:perfectomobileeq2.21.0.5
org.jenkins-ci.plugins:perfectomobileeq2.20.0.31
org.jenkins-ci.plugins:perfectomobileeq2.20.0.19
org.jenkins-ci.plugins:perfectomobileeq2.4.0.1

Name	Operator	Version
org.jenkins-ci.plugins:perfectomobile	eq	2.62.0.3
org.jenkins-ci.plugins:perfectomobile	eq	2.41.0.1
org.jenkins-ci.plugins:perfectomobile	eq	2.20.0.32
org.jenkins-ci.plugins:perfectomobile	eq	2.20.0.11
org.jenkins-ci.plugins:perfectomobile	eq	2.20.0.33
org.jenkins-ci.plugins:perfectomobile	eq	2.20.1.2
org.jenkins-ci.plugins:perfectomobile	eq	2.21.0.5
org.jenkins-ci.plugins:perfectomobile	eq	2.20.0.31
org.jenkins-ci.plugins:perfectomobile	eq	2.20.0.19
org.jenkins-ci.plugins:perfectomobile	eq	2.4.0.1