CVE-2019-10434

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins LDAP Email Plugin	0.8 and earlier

References

http://www.openwall.com/lists/oss-security/2019/10/01/2Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/10/01/2Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-10-01/#SECURITY-1515Vendor Advisory

Timeline

Published: Oct 1, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-104357.5Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in CVE-2019-104366.5An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and CVE-2019-104378.8A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers to connect to CVE-2019-104386.5A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission t CVE-2019-104394.3A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods al CVE-2019-10445.3A security feature bypass vulnerability exists when Windows Secure Kernel Mode fails to properly handle objects in memory. To exploit the vu CVE-2019-104408.8Jenkins NeoLoad Plugin 2.2.5 and earlier stored credentials unencrypted in its global configuration file and in job config.xml files on the CVE-2019-104414.3A cross-site request forgery vulnerability in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers to connect to an attacker-specifie CVE-2019-104424.3A missing permission check in Jenkins iceScrum Plugin 1.1.5 and earlier allowed attackers with Overall/Read permission to connect to an atta CVE-2019-104438.8Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be v CVE-2019-104446.5Jenkins Bumblebee HP ALM Plugin 4.1.3 and earlier unconditionally disabled SSL/TLS and hostname verification for connections to HP ALM.CVE-2019-104454.3A missing permission check in Jenkins Google Kubernetes Engine Plugin 0.7.0 and earlier allowed attackers with Overall/Read permission to ob