CVE-2019-10291

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Netsparker Cloud Scan Plugin	1.1.5 and older

References

http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1040Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/04/12/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/107790Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-04-03/#SECURITY-1040Vendor Advisory

Timeline

Published: Apr 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102926.5A cross-site request forgery vulnerability in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attack CVE-2019-102936.5A missing permission check in Jenkins Kmap Plugin in KmapJenkinsBuilder.DescriptorImpl form validation methods allows attackers with Overall CVE-2019-102948.8Jenkins Kmap Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Exte CVE-2019-102958.8Jenkins crittercism-dsym Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by use CVE-2019-102968.8Jenkins Serena SRA Deploy Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be vie CVE-2019-102978.8Jenkins Sametime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by us CVE-2019-102988.8Jenkins Koji Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users CVE-2019-102998.8Jenkins CloudCoreo DeployTime Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be CVE-2019-10304.3An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who CVE-2019-103008.0A cross-site request forgery vulnerability in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form v CVE-2019-103018.8A missing permission check in Jenkins GitLab Plugin 1.5.11 and earlier in the GitLabConnectionConfig#doTestConnection form validation method CVE-2019-103028.8Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they cou