cloudbees
[+] Credits: Joshua Platz aka Binary1985
[+] CVE ID: CVE-2019-11350
[+] Website: https://github.com/binary1985

[+] Source: https://github.com/binary1985/VulnerabilityDisclosure/blob/master/CloudBees%20Jenkins%20Operations%20Center%20Password%20Disclosure


Vendor:
==========================
https://www.cloudbees.com


Product:
===========
CloudBees Jenkins Operations Center
< Version 2.150.2.3

Jenkins and CloudBees. CloudBees is home to the original architects of Jenkins. Jenkins® is the most popular open source automation server, with more than 165,000 active sites, globally, and over 1,650,000 users. It was initially developed by Kohsuke Kawaguchi in 2004.


Vulnerability Type:
==========================
Cleartext Password Storage 
Password Retrieval


Vulnerability Details:
=====================

Jenkins CloudBees stores Passwords unencrypted for maintaining  
the proxy server configuration. These credentials can be retrieved
when a trial expires when and the proxy configuration page is opened.
The credentials will then be embedded directly into the HTLM in cleartext.


1) Open the Jenkins CloudBees application of an expired trial license


2) Click Request Trial License


3) View the HTLM source code, extracting the username, and password from the HTLM form.

Key value name(html form ID's):
proxypass(cleartext)


Remediation Details:
=====================
The vendor is preparing a patch.

2019-04-15 - Issue Reported to Vendor
2019-04-15 - CVE Requested
2019-04-19 - CVE-2019-11350 Issued
2019-05-06 - Vendor Confirmed Vulnerability (PRODSEC-52)
2019-07-08 - Vendor Patched Vulnerability (https://release-notes.cloudbees.com/release/21/8.18)

[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the
information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author
prohibits any malicious use of security related information
or exploits by the author or elsewhere.

Binary1985