← Back

CVE-2026-57302

nvd nist
Published: Jun 24, 2026Modified: Jun 26, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

Affected (1)

Products: Jenkins: Fitnesse
Jenkins
1 product
Fitnesse
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Fitnesse
Up to 1.36

Related CWEs

CWE-256
Plaintext Storage of a Password
Storing a password in plaintext may result in a system compromise.

References (1)

Source: jenkinsci-cert@googlegroups.com
Vendor Advisory

Timeline

No history available yet.