Password stored in plain text by Jenkins AppSpider Plugin

2022-05-2417:33:08

Google

osv.dev

0.0004 Low

EPSS

Percentile

12.8%

JSON

AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file com.rapid7.jenkinspider.PostBuildScan.xml on the Jenkins controller as part of its configuration.

This password can be viewed by users with access to the Jenkins controller file system.

AppSpider Plugin 1.0.13 stores a password encrypted once its configuration is saved again.

CPENameOperatorVersion
com.rapid7:jenkinsci-appspider-plugineq1.0.5
com.rapid7:jenkinsci-appspider-plugineq1.0.6
com.rapid7:jenkinsci-appspider-plugineq1.0.8
com.rapid7:jenkinsci-appspider-plugineq1.0.2
com.rapid7:jenkinsci-appspider-plugineq1.0.11
com.rapid7:jenkinsci-appspider-plugineq1.0.4
com.rapid7:jenkinsci-appspider-plugineq1.0.12
com.rapid7:jenkinsci-appspider-plugineq1.0.10
com.rapid7:jenkinsci-appspider-plugineq1.0.3
com.rapid7:jenkinsci-appspider-plugineq1.0.7

Name	Operator	Version
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.5
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.6
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.8
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.2
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.11
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.4
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.12
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.10
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.3
com.rapid7:jenkinsci-appspider-plugin	eq	1.0.7