Information Exposure Affecting com.acunetix:acunetix Open this link in a new tab package, versions [,1.1.0)
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications-
snyk-id
SNYK-JAVA-COMACUNETIX-450022
-
published
17 Jun 2019
-
disclosed
19 Feb 2019
-
credit
Viktor Gazdag
Introduced: 19 Feb 2019
CWE-200 Open this link in a new tabHow to fix?
Upgrade com.acunetix:acunetix
to version 1.1.0 or higher.
Overview
com.acunetix:acunetix is a package that allows you to trigger automated Acunetix scans as part of your web application’s build process inside of Jenkins.
Affected versions of this package are vulnerable to Information Exposure. The plugin stores the API Key in its configuration unencrypted in its global configuration file on the Jenkins master. This key could be viewed by users with access to the master file system.