CVE-2019-16542

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins Anchore Container Image Scanner Plugin	1.0.19 and earlier

References

http://www.openwall.com/lists/oss-security/2019/11/21/1Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1539Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/11/21/1Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1539Vendor Advisory

Timeline

Published: Nov 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-165435.5Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where CVE-2019-165448.8Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins mast CVE-2019-165456.5Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms CVE-2019-165465.9Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling CVE-2019-165474.3Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Re CVE-2019-165488.8A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could CVE-2019-165498.1Jenkins Maven Release Plugin 0.16.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks, allowing man CVE-2019-16556.1A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to cond CVE-2019-165508.8A cross-site request forgery vulnerability in a connection test form method in Jenkins Maven Release Plugin 0.16.1 and earlier allows attack CVE-2019-165518.8A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers to connect to an attacker-sp CVE-2019-165525.4A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to a CVE-2019-165538.8A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins eval