CVE-2019-1003038

CWE-522 — Insufficiently Protected Credentials5 documents5 sources
Severity
7.8HIGH
EPSS
0.0%
top 98.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Repository ConnectorJenkins Project Jenkins Repository Connector Plugin
Timeline
PublishedMar 8
Latest updateMay 13

Description

An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1.2.4 and earlier in src/main/java/org/jvnet/hudson/plugins/repositoryconnector/ArtifactDeployer.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/Repository.java, src/main/java/org/jvnet/hudson/plugins/repositoryconnector/UserPwd.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

🔴Vulnerability Details

3
OSV
Jenkins Repository Connector Plugin has insufficiently protected credentials↗2022-05-13
▶
GHSA
Jenkins Repository Connector Plugin has insufficiently protected credentials↗2022-05-13
▶
CVEList
CVE-2019-1003038: An insufficiently protected credentials vulnerability exists in Jenkins Repository Connector Plugin 1↗2019-03-08
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2019-03-06↗2019-03-06
▶