CVE-2019-10329

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins InfluxDB Plugin	1.21 and earlier

References

http://www.openwall.com/lists/oss-security/2019/05/31/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108540Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1403Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/05/31/2Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/108540Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-05-31/#SECURITY-1403Vendor Advisory

Timeline

Published: May 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-10335.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2019-103307.5Jenkins Gitea Plugin 1.1.1 and earlier did not implement trusted revisions, allowing attackers without commit access to the Git repo to chan CVE-2019-103314.3A cross-site request forgery vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed attack CVE-2019-103324.3A missing permission check in Jenkins ElectricFlow Plugin 1.1.5 and earlier in Configuration#doTestConnection allowed users with Overall/Rea CVE-2019-103334.3Missing permission checks in Jenkins ElectricFlow Plugin 1.1.5 and earlier in various HTTP endpoints allowed users with Overall/Read access CVE-2019-103346.5Jenkins ElectricFlow Plugin 1.1.5 and earlier disabled SSL/TLS and hostname verification globally for the Jenkins master JVM when MultipartU CVE-2019-103355.4A stored cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.5 and earlier allowed attackers able to configure jobs in Jen CVE-2019-103366.1A reflected cross site scripting vulnerability in Jenkins ElectricFlow Plugin 1.1.6 and earlier allowed attackers able to control the output CVE-2019-103377.5An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content o CVE-2019-103388.8A cross-site request forgery vulnerability in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient a CVE-2019-103398.8A missing permission check in Jenkins JX Resources Plugin 1.0.36 and earlier in GlobalPluginConfiguration#doValidateClient allowed users wit CVE-2019-10347.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who