CVE-2019-1003096

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Jenkins TestFairy Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins TestFairy Plugin	all versions as of 2019-04-03

References

http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1062Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1062Vendor Advisory

Timeline

Published: Apr 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10030976.5Jenkins Crowd Integration Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they CVE-2019-10030986.5A cross-site request forgery vulnerability in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation CVE-2019-10030996.5A missing permission check in Jenkins openid Plugin in the OpenIdSsoSecurityRealm.DescriptorImpl#doValidate form validation method allows at CVE-2019-100387.8Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applic CVE-2019-100399.8The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_lo CVE-2019-10047.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scrip CVE-2019-100409.8The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_lo CVE-2019-100419.8The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_lo CVE-2019-100427.5The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dir_lo CVE-2019-100448.8Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to an IDN homograph atta CVE-2019-100456.5The "action" get_sess_id in the web application of Pydio through 8.2.2 discloses the session cookie value in the response body, enabling scr CVE-2019-100465.3An unauthenticated attacker can obtain information about the Pydio 8.2.2 configuration including session timeout, libraries, and license inf