Common Weakness Enumeration
CWE-256
AllowedPlaintext Storage of a Password
Abstraction: Base · Status: Incomplete
The product stores a password in plaintext within resources such as memory or files.
422 vulnerabilities reference this CWE, most recent first.
GHSA-VX57-HPHR-3MR9
Vulnerability from github – Published: 2025-07-09 18:30 – Updated: 2025-11-05 20:13
VLAI
Summary
Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens
Details
Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it.
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:sensedia-api-platform"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53674"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-09T22:31:35Z",
"nvd_published_at": "2025-07-09T16:15:26Z",
"severity": "MODERATE"
},
"details": "Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potential for attackers to observe and capture it.",
"id": "GHSA-vx57-hphr-3mr9",
"modified": "2025-11-05T20:13:25Z",
"published": "2025-07-09T18:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53674"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/sensedia-api-platform-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-07-09/#SECURITY-3551"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/07/09/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Sensedia API Platform Plugin vulnerability exposes unencrypted tokens"
}
GHSA-W6C2-JRHH-JRXG
Vulnerability from github – Published: 2022-05-24 17:27 – Updated: 2022-12-20 22:39
VLAI
Summary
Credentials stored in plain text by Jenkins tfs Plugin
Details
tfs Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file hudson.plugins.tfs.TeamPluginGlobalConfig.xml on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:tfs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.157.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2249"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-311"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-20T22:39:49Z",
"nvd_published_at": "2020-09-01T14:15:00Z",
"severity": "LOW"
},
"details": "tfs Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file `hudson.plugins.tfs.TeamPluginGlobalConfig.xml` on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.",
"id": "GHSA-w6c2-jrhh-jrxg",
"modified": "2022-12-20T22:39:49Z",
"published": "2022-05-24T17:27:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2249"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/tfs-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1506"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/09/01/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Credentials stored in plain text by Jenkins tfs Plugin"
}
GHSA-W7RJ-J5F6-772G
Vulnerability from github – Published: 2022-07-12 00:00 – Updated: 2022-07-12 00:00
VLAI
Details
The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windows users of the system.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2022-1794"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-11T11:15:00Z",
"severity": "HIGH"
},
"details": "The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windows users of the system.",
"id": "GHSA-w7rj-j5f6-772g",
"modified": "2022-07-12T00:00:57Z",
"published": "2022-07-12T00:00:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1794"
},
{
"type": "WEB",
"url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17129\u0026token=1c1485c4a700c04f2069699f5be7558d276ca117\u0026download="
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-WCJJ-QM5V-J4PC
Vulnerability from github – Published: 2022-11-16 12:00 – Updated: 2025-04-30 20:25
VLAI
Summary
Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords
Details
Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.
Severity
6.5 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:reverse-proxy-auth-plugin"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.3"
},
{
"fixed": "1.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-45384"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-21T22:22:01Z",
"nvd_published_at": "2022-11-15T20:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Reverse Proxy Auth Plugin versions 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system.",
"id": "GHSA-wcjj-qm5v-j4pc",
"modified": "2025-04-30T20:25:23Z",
"published": "2022-11-16T12:00:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45384"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/reverse-proxy-auth-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/11/15/4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Reverse Proxy Auth Plugin vulnerable due to plaintext storage of passwords"
}
GHSA-WCJQ-XFXV-X7MX
Vulnerability from github – Published: 2026-06-04 15:30 – Updated: 2026-06-08 15:32
VLAI
Details
GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console. This issue allows physically-proximate attackers to obtain sensitive information, including network credentials, via monitoring the serial UART interface.
Severity
4.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-36174"
],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-04T15:16:51Z",
"severity": "MODERATE"
},
"details": "GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console. This issue allows physically-proximate attackers to obtain sensitive information, including network credentials, via monitoring the serial UART interface.",
"id": "GHSA-wcjq-xfxv-x7mx",
"modified": "2026-06-08T15:32:42Z",
"published": "2026-06-04T15:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-36174"
},
{
"type": "WEB",
"url": "https://github.com/BadChemical/IoT-Vulnerability-Research-Public/blob/main/GNCC-GP5-T23/README.md"
},
{
"type": "WEB",
"url": "http://gncc.com"
},
{
"type": "WEB",
"url": "http://gp5.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WG65-39GG-5WFJ
Vulnerability from github – Published: 2026-05-05 19:33 – Updated: 2026-09-09 15:33
VLAI
Summary
Prometheus Azure AD remote write OAuth client secret exposed via config API
Details
Impact
Users who use Azure AD remote write with OAuth authentication are impacted.
The client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.
Patches
The problem has been patched by changing ClientSecret in OAuthConfig to Secret. Users should upgrade to 3.11.3 or 3.5.3 LTS.
Workarounds
Users who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/prometheus/prometheus"
},
"ranges": [
{
"events": [
{
"introduced": "0.45.2"
},
{
"fixed": "0.311.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42151"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-256",
"CWE-312"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-05T19:33:47Z",
"nvd_published_at": "2026-05-04T19:16:04Z",
"severity": "HIGH"
},
"details": "### Impact\n\nUsers who use Azure AD remote write with OAuth authentication are impacted.\n\nThe `client_secret` field in the Azure AD remote write OAuth configuration (`storage/remote/azuread`) was typed as `string` instead of `Secret`. Prometheus redacts fields of type `Secret` when serving the configuration via the `/-/config` HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint.\n\n### Patches\n\nThe problem has been patched by changing `ClientSecret` in `OAuthConfig` to `Secret`. Users should upgrade to 3.11.3 or 3.5.3 LTS.\n\n### Workarounds\n\nUsers who can not upgrade can switch to Managed Identity or Workload Identity authentication for Azure AD remote write, which do not involve a client secret.",
"id": "GHSA-wg65-39gg-5wfj",
"modified": "2026-09-09T15:33:43Z",
"published": "2026-05-05T19:33:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/prometheus/prometheus/security/advisories/GHSA-wg65-39gg-5wfj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42151"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/prometheus/pull/18590"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/prometheus/pull/18587"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60388"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60387"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60386"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:57191"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:56340"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54427"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:54288"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53530"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53415"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53413"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:53412"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50874"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:50843"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60389"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60390"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60391"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60441"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:60477"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:63103"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-42151"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466507"
},
{
"type": "PACKAGE",
"url": "https://github.com/prometheus/prometheus"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.11.3"
},
{
"type": "WEB",
"url": "https://github.com/prometheus/prometheus/releases/tag/v3.5.3"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42151.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25039"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25245"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25504"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34357"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34359"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36651"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36797"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37267"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37271"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:37272"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40118"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40262"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40768"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40945"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40970"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40972"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40974"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41019"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41030"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41031"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41066"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42146"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42852"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:43052"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:44622"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:47149"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:47952"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Prometheus Azure AD remote write OAuth client secret exposed via config API"
}
GHSA-WJ85-RG5G-V8JM
Vulnerability from github – Published: 2024-05-30 18:15 – Updated: 2024-05-30 18:15
VLAI
Summary
TYPO3 Information Disclosure in User Authentication
Details
It has been discovered that login failures have been logged on the default stream with log level "warning" including plain-text user credentials.
Severity
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "typo3/cms-core"
},
"ranges": [
{
"events": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.5.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-30T18:15:08Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "It has been discovered that login failures have been logged on the default stream with log level \"warning\" including plain-text user credentials.",
"id": "GHSA-wj85-rg5g-v8jm",
"modified": "2024-05-30T18:15:08Z",
"published": "2024-05-30T18:15:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/TYPO3-CMS/core/commit/ac0565b7a539398a07adf21f04f85cd2574817d2"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-05-07-5.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/TYPO3-CMS/core"
},
{
"type": "WEB",
"url": "https://typo3.org/security/advisory/typo3-core-sa-2019-010"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "TYPO3 Information Disclosure in User Authentication"
}
GHSA-WMP3-7QC8-4X9F
Vulnerability from github – Published: 2023-03-03 06:30 – Updated: 2023-03-14 18:30
VLAI
Details
Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U(C) CPU modules all models all versions, FX5UJ CPU modules all models all versions, FX5S CPU modules all models all versions, FX5-ENET all versions and FX5-ENET/IP all versions allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-0457"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-522"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-03T05:15:00Z",
"severity": "HIGH"
},
"details": "Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U(C) CPU modules all models all versions, FX5UJ CPU modules all models all versions, FX5S CPU modules all models all versions, FX5-ENET all versions and FX5-ENET/IP all versions allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.",
"id": "GHSA-wmp3-7qc8-4x9f",
"modified": "2023-03-14T18:30:26Z",
"published": "2023-03-03T06:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0457"
},
{
"type": "WEB",
"url": "https://jvn.jp/vu/JVNVU93891523/index.html"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-23-061-01"
},
{
"type": "WEB",
"url": "https://www.mitsubishielectric.com/en/psirt/vulnerability/pdf/2022-023_en.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-WPHQ-J78P-FHGP
Vulnerability from github – Published: 2022-05-24 17:27 – Updated: 2022-12-21 00:21
VLAI
Summary
Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin
Details
Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.
Parameterized Remote Trigger Plugin 3.1.4 stores the secret encrypted once its configuration is saved again.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.3"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:Parameterized-Remote-Trigger"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-2239"
],
"database_specific": {
"cwe_ids": [
"CWE-256",
"CWE-311"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-21T00:21:31Z",
"nvd_published_at": "2020-09-01T14:15:00Z",
"severity": "LOW"
},
"details": "Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file `org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml` on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.\n\nParameterized Remote Trigger Plugin 3.1.4 stores the secret encrypted once its configuration is saved again.",
"id": "GHSA-wphq-j78p-fhgp",
"modified": "2022-12-21T00:21:31Z",
"published": "2022-05-24T17:27:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-2239"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/parameterized-remote-trigger-plugin/commit/2902ef5ea6eb077f43fd25c880e4920faea4e828"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/parameterized-remote-trigger-plugin"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2020-09-01/#SECURITY-1625"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2020/09/01/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin"
}
GHSA-WVH7-5P38-2QFC
Vulnerability from github – Published: 2020-07-23 18:20 – Updated: 2021-09-22 21:05
VLAI
Summary
Storing Password in Local Storage
Details
The setPassword method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the documentation under Users > Signing Up, it clearly states, "We never store passwords in plaintext, nor will we ever transmit passwords back to the client in plaintext."
Example Code:
async () => {
const user = Parse.User.current()
if (user) {
user.setPassword('newpass')
await user.save()
}
}
After running the above code, the new password will be stored in localStorage as a property named "password".
Proposed Solution: Before saving anything to localStorage, Parse should strip out any properties named "password" that are attempting to be stored with a Parse.User type object.
Configuration: Parse SDK: 2.9.1 Parse Server: 3.9.0
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "parse"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-256"
],
"github_reviewed": true,
"github_reviewed_at": "2020-07-23T18:18:24Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user\u0027s password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the documentation under Users \u003e Signing Up, it clearly states, \"We never store passwords in plaintext, nor will we ever transmit passwords back to the client in plaintext.\"\n\nExample Code:\n```js\nasync () =\u003e {\n const user = Parse.User.current()\n if (user) {\n user.setPassword(\u0027newpass\u0027)\n await user.save()\n }\n}\n```\nAfter running the above code, the new password will be stored in localStorage as a property named \"password\".\n\nProposed Solution:\nBefore saving anything to localStorage, Parse should strip out any properties named \"password\" that are attempting to be stored with a Parse.User type object.\n\nConfiguration:\nParse SDK: 2.9.1\nParse Server: 3.9.0",
"id": "GHSA-wvh7-5p38-2qfc",
"modified": "2021-09-22T21:05:43Z",
"published": "2020-07-23T18:20:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/parse-community/Parse-SDK-JS/security/advisories/GHSA-wvh7-5p38-2qfc"
},
{
"type": "WEB",
"url": "https://github.com/parse-community/Parse-SDK-JS/commit/d1106174571b699f972929dd7cbb8e45b5283cbb"
},
{
"type": "PACKAGE",
"url": "https://github.com/parse-community/Parse-SDK-JS"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Storing Password in Local Storage"
}
Mitigation
Architecture and Design
Avoid storing passwords in easily accessible locations.
Mitigation
Architecture and Design
Consider storing cryptographic hashes of passwords as an alternative to storing in plaintext.
Mitigation
A programmer might attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password because the encoding can be detected and decoded easily.
No CAPEC attack patterns related to this CWE.