Credentials transmitted in plain text by Repository Connector Plugin

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2020-2149 · ADVISORY
• jenkinsci/repository-connector-plugin · PACKAGE
• jenkins.io/security/advisory/2020-03-09 · WEB
• openwall.com/lists/oss-security/2020/03/09/1 · WEB

org.jenkins-ci.plugins:repository-connector のその他の脆弱性

• CVE-2022-36904中 4.3Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing…
• CVE-2022-36903中 4.3A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumera…
• CVE-2022-34195中 5.4Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on vi…
• CVE-2021-21618中 5.4Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a store…
• CVE-2019-1003038高 7.8An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/j…