CVE-2019-10428

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jenkins Aqua Security Scanner Plugin 3.0.17 and earlier transmitted configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Aqua Security Scanner Plugin	3.0.17 and earlier

References

http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1508Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/09/25/3Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-09-25/#SECURITY-1508Vendor Advisory

Timeline

Published: Sep 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-104295.5Jenkins GitLab Logo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by CVE-2019-10436.4A remote code execution vulnerability exists in the way that comctl32.dll handles objects in memory. The vulnerability could corrupt memory CVE-2019-104305.5Jenkins NeuVector Vulnerability Scanner Plugin 1.5 and earlier stored credentials unencrypted in its global configuration file on the Jenkin CVE-2019-104319.9A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions i CVE-2019-104325.4Jenkins HTML Publisher Plugin 1.20 and earlier did not escape the project and build display names in the HTML report frame, resulting in a c CVE-2019-104333.3Jenkins Dingding[钉钉] Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users w CVE-2019-104347.5Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resul CVE-2019-104357.5Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in CVE-2019-104366.5An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and CVE-2019-104378.8A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to CVE-2019-104386.5A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission t CVE-2019-104394.3A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods al