Skip to content
Heist/ feed
Unrated

Jenkins FitNesse Plugin stores passwords unencrypted

Type: advisorySource: OSV1 source record

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These passwords can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. As of publication of this advisory, there is no fix.

Announced Source revision 1
Original source ↗

GHSA-j4ph-wp3c-c37w

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:GHSA-j4ph-wp3c-c37w

org.jenkins-ci.plugins:fitnesse

Source reference: /affected/0/package/name

Affected versions
1.10

Source reference: /affected/0/versions

1.11

Source reference: /affected/0/versions

1.12

Source reference: /affected/0/versions

1.13

Source reference: /affected/0/versions

1.14

Source reference: /affected/0/versions

1.15

Source reference: /affected/0/versions

1.16

Source reference: /affected/0/versions

1.24

Source reference: /affected/0/versions

1.26

Source reference: /affected/0/versions

1.27

Source reference: /affected/0/versions

1.28

Source reference: /affected/0/versions

1.30

Source reference: /affected/0/versions

1.31

Source reference: /affected/0/versions

1.33

Source reference: /affected/0/versions

1.34

Source reference: /affected/0/versions

1.35

Source reference: /affected/0/versions

1.36

Source reference: /affected/0/versions

1.5

Source reference: /affected/0/versions

1.6

Source reference: /affected/0/versions

1.7

Source reference: /affected/0/versions

1.8

Source reference: /affected/0/versions

1.8.1

Source reference: /affected/0/versions

1.9

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "last_affected": "1.36"
          }
        ]
      }
    ],
    "package": {
      "name": "org.jenkins-ci.plugins:fitnesse",
      "purl": "pkg:maven/org.jenkins-ci.plugins/fitnesse",
      "ecosystem": "Maven"
    },
    "versions": [
      "1.10",
      "1.11",
      "1.12",
      "1.13",
      "1.14",
      "1.15",
      "1.16",
      "1.24",
      "1.26",
      "1.27",
      "1.28",
      "1.30",
      "1.31",
      "1.33",
      "1.34",
      "1.35",
      "1.36",
      "1.5",
      "1.6",
      "1.7",
      "1.8",
      "1.8.1",
      "1.9"
    ],
    "database_specific": {
      "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j4ph-wp3c-c37w/GHSA-j4ph-wp3c-c37w.json"
    }
  }
]
Related CVEs
CVE-2026-57302

Source reference: /aliases

Publisher severity

No explicit severity was provided.

Event
#17854 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement