CVE-2018-1000424 - An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin

Back Back to CVE browser

HIGH

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin

Published Jan 9, 2019

7.8

HIGH

CVSS 3.0

EPSS 0.33%

Description

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (4)

http://www.securityfocus.com/bid/106532
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-cvh8-9j4x-5v4j
Advisory
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-265
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000424

Link	Providers	Tags
http://www.securityfocus.com/bid/106532		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://github.com/advisories/GHSA-cvh8-9j4x-5v4j		Advisory
https://jenkins.io/security/advisory/2018-09-25/#SECURITY-265		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-1000424