CVE-2019-10348

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Jenkins Gogs Plugin stored credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Gogs Plugin	1.0.14 and earlier

References

http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109156Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1438Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-837/Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2019/07/11/4Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/109156Third Party Advisory, VDB Entry
https://jenkins.io/security/advisory/2019-07-11/#SECURITY-1438Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-837/Third Party Advisory, VDB Entry

Timeline

Published: Jul 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-103495.4A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure j CVE-2019-10357.8A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory. An attacker who CVE-2019-103508.8Jenkins Port Allocator Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users CVE-2019-103518.8Jenkins Caliper CI Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users wit CVE-2019-103526.5A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.j CVE-2019-103537.5CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass C CVE-2019-103544.3A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fra CVE-2019-103558.8A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to CVE-2019-103568.8A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allo CVE-2019-103574.3A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to ob CVE-2019-103586.5Jenkins Maven Integration Plugin 3.3 and earlier did not apply build log decorators to module builds, potentially revealing sensitive build CVE-2019-103596.3A cross-site request forgery vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier in the M2ReleaseAction#doSubmit method allowed