Description (CNA)
An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the password stored in the plugin configuration.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Jenkins project / Jenkins Repository Connector Plugin | affected 1.2.4 and earlier |
CWE
No CWE identifiers supplied.
References
- https://jenkins.io/security/advisory/2019-03-06/#SECURITY-958
- http://www.securityfocus.com/bid/107476
ADP enrichment
No English description supplied.