Jenkins Gogs Plugin stored credentials in plain text
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Dec 5, 2023
Package
Affected versions
<= 1.0.14
Patched versions
1.0.15
Description
Published by the National Vulnerability Database
Jul 11, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Oct 26, 2023
Last updated
Dec 5, 2023
Jenkins Gogs Plugin stored credentials unencrypted in job
config.xml
files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.Gogs Plugin now stores credentials encrypted.
References