CVE-2018-1000057

MEDIUM Year: 2018
CVSS v3 Score
4.3
Medium
CVSS v2 Score
4.0
Medium
Weakness Type
CWE-522
View all →

Vulnerability Description

Jenkins Credentials Binding Plugin 1.14 and earlier masks passwords it provides to build processes in their build logs. Jenkins however transforms provided password values, e.g. replacing environment variable references, which could result in values different from but similar to configured passwords being provided to the build. Those values are not subject to masking, and could allow unauthorized users to recover the original password.

Related Vulnerabilities

CVE-2019-10224

MEDIUM
CVSS:4.3(Medium)

A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager p...

CWE-5222019

CVE-2019-10421

MEDIUM
CVSS:4.3(Medium)

Jenkins Azure Event Grid Build Notifier Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access t...

CWE-5222019

CVE-2020-17489

MEDIUM
CVSS:4.3(Medium)

An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible....

CWE-5222020

CVE-2020-2095

MEDIUM
CVSS:4.3(Medium)

Jenkins Redgate SQL Change Automation Plugin 2.0.4 and earlier stored an API key unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permis...

CWE-5222020

CVE-2020-2107

MEDIUM
CVSS:4.3(Medium)

Jenkins Fortify Plugin 19.1.29 and earlier stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or a...

CWE-5222020

CVE-2020-2124

MEDIUM
CVSS:4.3(Medium)

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permis...

CWE-5222020