Jenkin allows attackers to obtain passwords by reading the HTML source code
Date: 2022-05
Affected: maven/org.jenkins-ci.main:jenkins-core, maven/org.jenkins-ci.main:jenkins-core
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2014-2061
CVE-2014-2065
CVE-2014-2067
CWE: CWE-79

The input control in PasswordParameterDefinition in Jenkins before 1.551 and LTS before 1.532.2 allows remote attackers to obtain passwords by reading the HTML source code, related to the default value.


Mitigations:

Architectural layers (MAESTRO):