CVE-2019-10366

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Jenkins Skytap Cloud CI Plugin 2.06 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Skytap Cloud CI Plugin	2.06 and earlier

References

http://www.openwall.com/lists/oss-security/2019/07/31/1Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1429Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-833/Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2019/07/31/1Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-07-31/#SECURITY-1429Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-19-833/Third Party Advisory, VDB Entry

Timeline

Published: Jul 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-103675.5Due to an incomplete fix of CVE-2019-10343, Jenkins Configuration as Code Plugin 1.26 and earlier did not properly apply masking to some val CVE-2019-103688.8A cross-site request forgery vulnerability in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection an CVE-2019-103696.5A missing permission check in Jenkins JClouds Plugin 2.14 and earlier in BlobStoreProfile.DescriptorImpl#doTestConnection and JCloudsCloud.D CVE-2019-10377.0An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting Elevatio CVE-2019-103706.5Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, po CVE-2019-103717.5A session fixation vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows unauthorized att CVE-2019-103726.1An open redirect vulnerability in Jenkins Gitlab Authentication Plugin 1.4 and earlier in GitLabSecurityRealm.java allows attackers to redir CVE-2019-103735.4A stored cross-site scripting vulnerability in Jenkins Build Pipeline Plugin 1.5.8 and earlier allows attackers able to edit the build pipel CVE-2019-103745.4A stored cross-site scripting vulnerability in Jenkins PegDown Formatter Plugin 1.3 and earlier allows attackers able to edit descriptions a CVE-2019-103756.5An arbitrary file read vulnerability in Jenkins File System SCM Plugin 2.1 and earlier allows attackers able to configure jobs in Jenkins to CVE-2019-103766.1A reflected cross-site scripting vulnerability in Jenkins Wall Display Plugin 0.6.34 and earlier allows attackers to inject arbitrary HTML a CVE-2019-103774.3A missing permission check in Jenkins Avatar Plugin 1.2 and earlier allows attackers with Overall/Read access to change the avatar of any us