CVE-2018-1000104

CWE-522 — Insufficiently Protected Credentials5 documents5 sources
Severity
7.8HIGH
EPSS
0.0%
top 98.87%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Jenkins Coverity
Timeline
PublishedMar 13
Latest updateMay 13

Description

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured keystore and private key passwords.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶NVDjenkins/coverity1.10.0

🔴Vulnerability Details

3
GHSA
Jenkins Coverity Plugin has Insufficiently Protected Credentials↗2022-05-13
▶
OSV
Jenkins Coverity Plugin has Insufficiently Protected Credentials↗2022-05-13
▶
CVEList
CVE-2018-1000104: A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1↗2018-03-13
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2018-02-26↗2018-02-26
▶