CVE-2018-1000423: Insufficiently Protected Credentials

May 13, 2022 (updated January 9, 2024)

An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2.

References

www.securityfocus.com/bid/106532
github.com/advisories/GHSA-cg6q-gp23-vwx8
github.com/jenkinsci/crowd2-plugin/commit/580be2a0dfb38d494420901f03555092b885a85f
jenkins.io/security/advisory/2018-09-25/
nvd.nist.gov/vuln/detail/CVE-2018-1000423

Code Behaviors & Features

Detect and mitigate CVE-2018-1000423 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →