CVE-2019-10283

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins mabl Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins mabl Plugin	all versions as of 2019-04-03

References

http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-946Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-946Vendor Advisory

Timeline

Published: Apr 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102848.8Jenkins Diawi Upload Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w CVE-2019-102858.8Jenkins Minio Storage Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed CVE-2019-102868.8Jenkins DeployHub Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with CVE-2019-102878.8Jenkins youtrack-plugin Plugin 0.7.1 and older stored credentials unencrypted in its global configuration file on the Jenkins master where t CVE-2019-102888.8Jenkins Jabber Server Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed CVE-2019-102896.5A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doVal CVE-2019-10295.9A denial of service vulnerability exists in Skype for Business. An attacker who successfully exploited the vulnerability could cause Skype f CVE-2019-102906.5A missing permission check in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpl#doValidateAPI form va CVE-2019-102918.8Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master w CVE-2019-102926.5A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attack CVE-2019-102936.5A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall CVE-2019-102948.8Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Exte