Cleartext storage of sensitive information in AppDynamics Dashboard - #VU17922
Published: March 7, 2019
Vulnerability identifier: #VU17922
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-312
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to the AppDynamics Dashboard Plugin stores username and password in its configuration unencrypted in jobs'
config.xml files on the Jenkins master. A local user can view credentials of other users.
Affected software
AppDynamics Dashboard
Remediation
Install update from vendor's website.
AppDynamics Dashboard - update to 1.0.15