Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin
Date: 2022-05
Affected: maven/com.elasticbox.jenkins-ci.plugins:elasticbox
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2019-10440
CVE-2019-10443
CVE-2019-10447
CVE-2019-10448
CVE-2019-10450
CWE: CWE-312
CWE-522
CVSS: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.


Mitigations:

Architectural layers (MAESTRO):