Jenkins Azure AD Plugin stored the client secret unencrypted
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:azure-ad
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2019-10309
CVE-2019-10318
CWE: CWE-522
CWE-611
CVSS: 3.3 (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Jenkins Azure AD Plugin stored the client secret unencrypted in the global config.xml configuration file on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Azure AD Plugin now stores the client secret encrypted.


Mitigations:

Architectural layers (MAESTRO):