Jenkins Nomad Plugin 0.7.4 and earlier stores Docker passwords unencrypted in the global config.xml file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2021/08/31/1 | Mailing List Third Party Advisory |
| https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2396 | Vendor Advisory |
Configurations
History
25 Apr 2022, 17:25
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-522 |
08 Sep 2021, 13:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:jenkins:nomad:*:*:*:*:*:jenkins:*:* | |
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 5.5 |
| References | (CONFIRM) https://www.jenkins.io/security/advisory/2021-08-31/#SECURITY-2396 - Vendor Advisory | |
| References | (MLIST) http://www.openwall.com/lists/oss-security/2021/08/31/1 - Mailing List, Third Party Advisory |
31 Aug 2021, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 Aug 2021, 14:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-08-31 14:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-21681
Mitre link : CVE-2021-21681
CVE.ORG link : CVE-2021-21681
JSON object : View
Products Affected
jenkins
- nomad
CWE
CWE-522
Insufficiently Protected Credentials