CVE-2019-1003075

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins Audit to Database Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Audit to Database Plugin	all versions as of 2019-04-03

References

http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-966Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-966Vendor Advisory

Timeline

Published: Apr 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10030766.5A cross-site request forgery vulnerability in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection fo CVE-2019-10030776.5A missing permission check in Jenkins Audit to Database Plugin in the DbAuditPublisherDescriptorImpl#doTestJdbcConnection form validation me CVE-2019-10030786.5A cross-site request forgery vulnerability in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection for CVE-2019-10030796.5A missing permission check in Jenkins VMware Lab Manager Slaves Plugin in the LabManager.DescriptorImpl#doTestConnection form validation met CVE-2019-10030806.5A cross-site request forgery vulnerability in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheck CVE-2019-10030816.5A missing permission check in Jenkins OpenShift Deployer Plugin in the DeployApplication.DeployApplicationDescriptor#doCheckLogin form valid CVE-2019-10030826.5A cross-site request forgery vulnerability in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allo CVE-2019-10030836.5A missing permission check in Jenkins Gearman Plugin in the GearmanPluginConfig#doTestConnection form validation method allows attackers wit CVE-2019-10030846.5A cross-site request forgery vulnerability in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form va CVE-2019-10030856.5A missing permission check in Jenkins Zephyr Enterprise Test Management Plugin in the ZeeDescriptor#doTestConnection form validation method CVE-2019-10030866.5A cross-site request forgery vulnerability in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection fo CVE-2019-10030876.5A missing permission check in Jenkins Chef Sinatra Plugin in the ChefBuilderConfiguration.DescriptorImpl#doTestConnection form validation me