Skytap Cloud CI Plugin stored credentials in plain text
Date: 2022-05
Affected: maven/org.jenkins-ci.plugins:skytap
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2019-10343
CVE-2019-10360
CVE-2019-10366
CWE: CWE-522
CWE-532
CWE-79
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.


Mitigations:

Architectural layers (MAESTRO):