CVE-2019-10299 - Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system

Back Back to CVE browser

HIGH

Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system

Published Apr 4, 2019

8.8

HIGH

CVSS 3.1

EPSS 1.74%

Description

Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Affected products

Vendor Jenkins project Product Jenkins CloudCoreo DeployTime Plugin Default
unknown
Affected
- all versions as of 2019-04-03

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Jenkins project	Jenkins CloudCoreo DeployTime Plugin	unknown	Affected all versions as of 2019-04-03

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (6)

http://www.openwall.com/lists/oss-security/2019/04/12/2
mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.securityfocus.com/bid/107790
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3011
Advisory
https://github.com/advisories/GHSA-7hf6-hggp-vvp9
Advisory
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-960
x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10299

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2019/04/12/2		mailing-listx_refsource_MLISTMailing ListThird Party Advisory
http://www.securityfocus.com/bid/107790		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3011		Advisory
https://github.com/advisories/GHSA-7hf6-hggp-vvp9		Advisory
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-960		x_refsource_CONFIRMVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-10299