What is GHSA-cvh8-9j4x-5v4j?

GHSA-cvh8-9j4x-5v4j is a security advisory published by GitHub Security Advisories with High severity. Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk

Which CVE IDs does GHSA-cvh8-9j4x-5v4j cover?

GHSA-cvh8-9j4x-5v4j covers the following CVE IDs: CVE-2018-1000424. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cvh8-9j4x-5v4j?

GHSA-cvh8-9j4x-5v4j has a CVSS v3 base score of 7.8, published by GitHub Security Advisories.

Which products are affected by GHSA-cvh8-9j4x-5v4j?

GHSA-cvh8-9j4x-5v4j affects 1 product, including: maven/org.jenkins-ci.plugins:artifactory:\u003c 2.16.2.

GHSA-cvh8-9j4x-5v4jHighCVSS 7.8

Jenkins Artifactory Plugin stored old directly entered credentials unencrypted on disk

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2018-1000424 →

📋 Description

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.

🎯 Affected products1

maven/org.jenkins-ci.plugins:artifactory:< 2.16.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2018-1000424
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-265
http://www.securityfocus.com/bid/106532
https://github.com/advisories/GHSA-cvh8-9j4x-5v4j