CVE-2018-1000423

Description

An insufficiently protected credentials vulnerability exists in Jenkins Crowd 2 Integration Plugin 2.0.0 and earlier in CrowdSecurityRealm.java, CrowdConfigurationService.java that allows attackers with local file system access to obtain the credentials used to connect to Crowd 2.

CVSS Version 3.0

nvd

CVE ID: CVE-2018-1000423
Base Score: 7.8
Base Severity: HIGH
Vector String:CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS Version 2.0

nvd

CVE ID: CVE-2018-1000423
Base Score: 2.1
Base Severity: LOW
Vector String:AV:L/AC:L/Au:N/C:P/I:N/A:N

Refrence: NVD