Passwords stored in plain text by ElasTest Plugin

2022-05-2417:28:27

Google

osv.dev

0.0004 Low

EPSS

Percentile

12.6%

JSON

Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

CPENameOperatorVersion
org.jenkins-ci.plugins:elastesteq1.2.1
org.jenkins-ci.plugins:elastesteq0.9.1-beta-2
org.jenkins-ci.plugins:elastesteq1.0.0-beta7
org.jenkins-ci.plugins:elastesteq1.0.0-beta1
org.jenkins-ci.plugins:elastesteq1.0.0-beta6
org.jenkins-ci.plugins:elastesteq0.9.1
org.jenkins-ci.plugins:elastesteq0.10.0-beta2
org.jenkins-ci.plugins:elastesteq0.10.0-beta1
org.jenkins-ci.plugins:elastesteq0.9.1-beta-4
org.jenkins-ci.plugins:elastesteq1.0-beta5

Name	Operator	Version
org.jenkins-ci.plugins:elastest	eq	1.2.1
org.jenkins-ci.plugins:elastest	eq	0.9.1-beta-2
org.jenkins-ci.plugins:elastest	eq	1.0.0-beta7
org.jenkins-ci.plugins:elastest	eq	1.0.0-beta1
org.jenkins-ci.plugins:elastest	eq	1.0.0-beta6
org.jenkins-ci.plugins:elastest	eq	0.9.1
org.jenkins-ci.plugins:elastest	eq	0.10.0-beta2
org.jenkins-ci.plugins:elastest	eq	0.10.0-beta1
org.jenkins-ci.plugins:elastest	eq	0.9.1-beta-4
org.jenkins-ci.plugins:elastest	eq	1.0-beta5