CVE-2018-1000424

HIGH Year: 2018
CVSS v3 Score
7.8
High
CVSS v2 Score
2.1
Low
Weakness Type
CWE-522
View all →

Vulnerability Description

An insufficiently protected credentials vulnerability exists in Jenkins Artifactory Plugin 2.16.1 and earlier in ArtifactoryBuilder.java, CredentialsConfig.java that allows attackers with local file system access to obtain old credentials configured for the plugin before it integrated with Credentials Plugin.

Related Vulnerabilities

CVE-2014-8938

HIGH
CVSS:7.8(High)

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line.

CWE-5222014

CVE-2017-1000387

HIGH
CVSS:7.8(High)

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file hudson.plugins.build_publisher.BuildPublisher.xml in the Jenkins master home directory...

CWE-5222017

CVE-2017-1201

HIGH
CVSS:7.8(High)

IBM BigFix Compliance Analytics 1.9.79 (TEMA SUAv1 SCA SCM) stores user credentials in clear text which can be read by a local user. IBM X-Force ID: 123676.

CWE-5222017

CVE-2017-1231

HIGH
CVSS:7.8(High)

IBM BigFix Platform 9.5 - 9.5.9 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 123910.

CWE-5222017

CVE-2017-1362

HIGH
CVSS:7.8(High)

IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 126801.

CWE-5222017

CVE-2017-1378

HIGH
CVSS:7.8(High)

IBM Spectrum Protect 7.1 and 8.1 (formerly Tivoli Storage Manager) disclosed unencrypted login credentials to Vmware vCenter in the application trace output which could be obtained by a local user. IB...

CWE-5222017