Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password
Low severity
GitHub Reviewed
Published
May 13, 2022
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Package
Affected versions
<= 1.2.6.1
Patched versions
2.0.0
Description
Published by the National Vulnerability Database
Jun 26, 2018
Published to the GitHub Advisory Database
May 13, 2022
Reviewed
Dec 7, 2022
Last updated
Feb 1, 2023
A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured password. IBM z/OS Connector Plugin 2.0.0 and newer integrates with Credentials Plugin, no longer storing credentials itself.
References