What is GHSA-qh3m-c6hw-5hmv?

GHSA-qh3m-c6hw-5hmv is a security advisory published by GitHub Security Advisories with Medium severity. Jenkins Rundeck Plugin stored credentials in plain text

Which CVE IDs does GHSA-qh3m-c6hw-5hmv cover?

GHSA-qh3m-c6hw-5hmv covers the following CVE IDs: CVE-2019-16556. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qh3m-c6hw-5hmv?

GHSA-qh3m-c6hw-5hmv has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-qh3m-c6hw-5hmv?

GHSA-qh3m-c6hw-5hmv affects 1 product, including: maven/org.jenkins-ci.plugins:rundeck:\u003c= 3.6.5.

GHSA-qh3m-c6hw-5hmvMediumCVSS 6.5

Jenkins Rundeck Plugin stored credentials in plain text

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 30, 2024

🔗 CVE IDs covered (1)

CVE-2019-16556 →

📋 Description

Jenkins Rundeck Plugin 3.6.5 and earlier stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

🎯 Affected products1

maven/org.jenkins-ci.plugins:rundeck:<= 3.6.5

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-16556
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1636
http://www.openwall.com/lists/oss-security/2019/12/17/1
https://github.com/advisories/GHSA-qh3m-c6hw-5hmv