Executive Summary

This vulnerability affects Jenkins versions 2.567 and earlier, as well as LTS 2.555.2 and earlier. It occurs because secrets submitted via POST requests to config.xml are not encrypted before being stored in the job configuration files on the Jenkins controller.

As a result, these secrets are stored in plaintext within the job config.xml files, making them accessible to users who have Item/Extended Read permissions or those who can access the Jenkins controller's file system.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive information, such as secrets or credentials, because they are stored unencrypted in job configuration files.

Users with certain permissions or access to the Jenkins controller file system could view these secrets, potentially leading to security breaches or misuse of confidential data.

Useful 0 Not Useful 0