CVE-2019-16568

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Jenkins SCTMExecutor Plugin 2.2 and earlier transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-319

Affected software

Vendor	Product	Versions
Jenkins project	Jenkins SCTMExecutor Plugin	>= unspecified, <= 2.2

References

http://www.openwall.com/lists/oss-security/2019/12/17/1Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1521Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/12/17/1Mailing List, Third Party Advisory
https://jenkins.io/security/advisory/2019-12-17/#SECURITY-1521Vendor Advisory

Timeline

Published: Dec 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-165694.3A cross-site request forgery vulnerability in Jenkins Mantis Plugin 0.26 and earlier allows attackers to connect to an attacker-specified we CVE-2019-16574.3A vulnerability in Cisco AMP Threat Grid could allow an authenticated, remote attacker to access sensitive information. The vulnerability is CVE-2019-165708.8A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specifie CVE-2019-165714.3A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an atta CVE-2019-165725.5Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can CVE-2019-165738.8A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an atta CVE-2019-165746.5A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to conne CVE-2019-165758.8A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an at CVE-2019-165766.5A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to con CVE-2019-16587.4A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker t CVE-2019-16597.4A vulnerability in the Identity Services Engine (ISE) integration feature of Cisco Prime Infrastructure (PI) could allow an unauthenticated,CVE-2019-16605.3A vulnerability in the Simple Object Access Protocol (SOAP) of Cisco TelePresence Management Suite (TMS) software could allow an unauthentic