CVE-2019-1003063
Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text
Résumé
Jenkins Amazon SNS Build Notifier Plugin stores credentials in plain text
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.snsnotify.AmazonSNSNotifier.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Maven
org.jenkins-ci.plugins:snsnotify
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37"}]}]
Références
- advisory nvd.nist.gov
- package github.com
- web github.com
- web jenkins.io
- web openwall.com