GHSA-wchh-wvpx-pf47: Medium severity Jenkins Upload to pgyer Plugin vulnerability

Published Apr 4, 2019

Updated

Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Affected Software

1 affected component

Jenkins Upload to pgyer Plugin

Event History

Apr 4, 2019

CVE Published

via OSV·04:29 PM

Data Sourced

via OSV·04:29 PM

DescriptionSeverity

Frequently Asked Questions

Who can view the exposed credentials?

Users with Jenkins Extended Read permission can view the credentials in job config.xml files. Anyone with access to the Jenkins master file system can also access them.

What access does an attacker need to exploit this issue?

An attacker needs either Extended Read permission in Jenkins or access to the Jenkins master file system. No user interaction is required once that access is available.

Where should administrators look for potential credential exposure?

Review job config.xml files on the Jenkins master, as the plugin stores its credentials there without encryption.

GHSA-wchh-wvpx-pf47: Medium severity Jenkins Upload to pgyer Plugin vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can view the exposed credentials?

What access does an attacker need to exploit this issue?

Where should administrators look for potential credential exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can view the exposed credentials?

What access does an attacker need to exploit this issue?

Where should administrators look for potential credential exposure?