Cleartext storage of sensitive information in ECS publisher - #VU18069
Published: March 25, 2019
Vulnerability identifier: #VU18069
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-312
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to application stores the API token unencrypted in jobs' config.xml files and its global configuration file on the Jenkins master. A user with Extended Read permission or access to the master file system can obtain to the API token.
Affected software
ECS publisher
Remediation
Install updates from vendor's website.
ECS publisher - update to 1.0.1