CVE-2021-21681
Password stored in plain text by Jenkins Nomad Plugin
5.5
MEDIUM
CVSS 3.1
EPSS 0.01%
Description
Jenkins Nomad Plugin 0.7.4 and earlier stores the passwords to authenticate against the Docker registry unencrypted in the global `config.xml` file on the Jenkins controller as part of its worker templates configuration. These passwords can be viewed by users with access to the Jenkins controller file system. Jenkins Nomad Plugin 0.7.5 stores the Docker passwords encrypted. This change is effective after Jenkins restarts.
How to fix CVE-2021-21681
To remediate CVE-2021-21681, upgrade the affected package to a fixed version below.
- —upgrade to 0.7.5 or later
Is CVE-2021-21681 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- from 0, < 0.7.5
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |