CVE-2018-1000104 Jenkins Coverity Plugin has Insufficiently Protected Credentials

What is CVE-2018-1000104?

CVE-2018-1000104 is a high-severity vulnerability in n/a, published on 13 Mar 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured keystore and private key passwords.

Weakness: CWE-522

Which versions are affected by CVE-2018-1000104?

2 open source packages ship an affected version, including org.jenkins-ci.plugins:coverity. It affects 1 product.

Products include Jenkins Coverity.

How do I fix CVE-2018-1000104?

Upgrade org.jenkins-ci.plugins:coverity to 1.11.0 or later.

Is CVE-2018-1000104 being exploited?

There is no known exploitation of CVE-2018-1000104 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-36920 Jenkins Coverity Plugin vulnerable to cross-site request forgery (CSRF) High 8.8
• CVE-2022-36921 Missing permission check in Coverity Plugin allows capturing credentials High 8.1
• CVE-2022-36919 Jenkins Coverity Plugin allows attackers with Overall/Read permission to enumerate credentials IDs Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cghg-jcv6-4v5m.