GHSA-gqxr-hvrw-6hfhLowCVSS 3.1

Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking

Published
May 16, 2023
Last Modified
November 11, 2023

🔗 CVE IDs covered (1)

📋 Description

Jenkins NS-ND Integration Performance Publisher Plugin stores credentials in job config.xml files on the Jenkins controller as part of its configuration.

While these credentials are stored encrypted on disk, in NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them.

NS-ND Integration Performance Publisher Plugin 4.11.0.48 masks credentials displayed on the configuration form.

🎯 Affected products1

  • maven/io.jenkins.plugins:cavisson-ns-nd-integration:< 4.11.0.48

🔗 References (3)