CVE-2019-10294

HIGH8.8EPSS 0.07%

Jenkins Kmap Plugin stores credentials in plain text

Published: 5/13/2022Modified: 1/30/2024

Description

Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Affected packages (1)

Maven/org.jenkins-ci.plugins:kmap-jenkins

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2019-10294
WEBhttps://jenkins.io/security/advisory/2019-04-03/#SECURITY-1056
WEBhttp://www.openwall.com/lists/oss-security/2019/04/12/2
WEBhttp://www.securityfocus.com/bid/107790