What is GHSA-phwr-pmh3-m8g2?

GHSA-phwr-pmh3-m8g2 is a security advisory published by GitHub Security Advisories with Low severity. Jenkins aws-device-farm Plugin stores credentials in plain text

Which CVE IDs does GHSA-phwr-pmh3-m8g2 cover?

GHSA-phwr-pmh3-m8g2 covers the following CVE IDs: CVE-2019-1003064. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-phwr-pmh3-m8g2?

GHSA-phwr-pmh3-m8g2 has a CVSS v3 base score of 3.3, published by GitHub Security Advisories.

Which products are affected by GHSA-phwr-pmh3-m8g2?

GHSA-phwr-pmh3-m8g2 affects 1 product, including: maven/org.jenkins-ci.plugins:aws-device-farm:\u003c 1.26.

GHSA-phwr-pmh3-m8g2LowCVSS 3.3

Jenkins aws-device-farm Plugin stores credentials in plain text

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

October 26, 2023

🔗 CVE IDs covered (1)

CVE-2019-1003064 →

📋 Description

Jenkins aws-device-farm Plugin stores credentials unencrypted in its global configuration file org.jenkinsci.plugins.awsdevicefarm.AWSDeviceFarmRecorder.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.

🎯 Affected products1

maven/org.jenkins-ci.plugins:aws-device-farm:< 1.26

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2019-1003064
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-835
http://www.openwall.com/lists/oss-security/2019/04/12/2
https://github.com/jenkinsci/aws-device-farm-plugin/commit/2d8cfe3cdd299c152ca5d13aada51cb69d0fec88
https://github.com/advisories/GHSA-phwr-pmh3-m8g2