Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:azure-publishersettings-credentials
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2019-10303
CWE: CWE-522
CVSS: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Jenkins Azure PublisherSettings Credentials Plugin stored the service management certificate unencrypted in credentials.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Azure PublisherSettings Credentials Plugin has been deprecated. Azure PublisherSettings Credentials Plugin 1.5 no longer provides any user features and we recommend the plugin be uninstalled.


Mitigations:

Architectural layers (MAESTRO):