Jenkins Crowd Integration Plugin stores credentials in plain text
Date: 2022-05
Affected: maven/com.ds.tools.hudson:crowd
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2019-1003053
CVE-2019-1003088
CVE-2019-1003089
CVE-2019-1003096
CVE-2019-1003097
CVE-2019-10277
CVE-2019-10280
CVE-2019-10294
CWE: CWE-311
CWE-522
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.


Mitigations:

Architectural layers (MAESTRO):