CVE-2026-57302

MediumCVSS 4.3/10Last modified Oct 25, 2026

Description

Jenkins FitNesse Plugin 1.36 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-256

Affected software

Vendor	Product	Versions
Jenkins Project	Jenkins FitNesse Plugin	1.36

References

https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3555Vendor Advisory

Timeline

Published: Jun 24, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-573037.1Jenkins Assembla Plugin 1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing attackers a CVE-2026-573045.4A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacke CVE-2026-573055.4A cross-site request forgery (CSRF) vulnerability in Jenkins Assembla Plugin 1.4 and earlier allows attackers to connect to an attacker-spec CVE-2026-573064.2A cross-site request forgery (CSRF) vulnerability in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers to co CVE-2026-573074.2A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission CVE-2026-573089.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with CVE-2026-573099.3A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into UR CVE-2026-57319.8Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. S CVE-2026-573106.3Windu CMS uses hashing algorithm based on MD5 and SHA1 with static salt to store user passwords. This allows an attacker who obtain password CVE-2026-573115.3Windu CMS does not validate types of uploaded files. An authenticated attacker can upload arbitrary files, including PHP. This can lead to R CVE-2026-573127.1Unauthenticated Cross Site Scripting (XSS) in Everest Forms <= 3.4.8 versions.CVE-2026-573136.5Subscriber Cross Site Scripting (XSS) in SureCart <= 4.2.2 versions.