Sensitive Information Leakage

2018-04-1701:51:06

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

28.6%

JSON

Jenkins perforce plugin is vulnerable to sensitive information leakage. It does not properly secure the credentials because PerforcePasswordEncryptor.java. uses DES and an encryption key stored in its public source code, allowing unauthorized users to get the Perforce passwords configured in jobs.

CPENameOperatorVersion
perforce pluginle1.3.23-h-1
perforce pluginle1.1.14

CPE	Name	Operator	Version
	perforce plugin	le	1.3.23-h-1
	perforce plugin	le	1.1.14

References

github.com/jenkinsci/perforce-plugin/blob/4beaabe78faf62a8cfad340e933f1ff0bd2d07c1/src/main/java/hudson/plugins/perforce/PerforcePasswordEncryptor.java#L42

jenkins.io/security/advisory/2018-03-26/#SECURITY-536

0.001 Low

EPSS

Percentile

28.6%

JSON

Related for VERACODE:6123