CVE-2019-10303
Jenkins Azure PublisherSettings Credentials Plugin stored credentials in plain text
3.3
LOW
CVSS 3.1
EPSS 0.07%
描述
Jenkins Azure PublisherSettings Credentials Plugin stored the service management certificate unencrypted in credentials.xml on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system. Azure PublisherSettings Credentials Plugin has been deprecated. Azure PublisherSettings Credentials Plugin 1.5 no longer provides any user features and we recommend the plugin be uninstalled.
如何修補 CVE-2019-10303
要修補 CVE-2019-10303,請將受影響套件升級到下列已修補版本。
- —升級至 1.5 或更新版本
CVE-2019-10303 正在被利用嗎?
低 — EPSS 為 0.1%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- from 0, < 1.5
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | LOW3.3 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |