CVE-2019-10318

CWE-522 — Insufficiently Protected Credentials5 documents5 sources
Severity
8.8HIGH
EPSS
0.1%
top 77.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Azure ADJenkins Project Jenkins Azure AD Plugin
Timeline
PublishedApr 30
Latest updateMay 24

Description

Jenkins Azure AD Plugin 0.3.3 and earlier stored the client secret unencrypted in the global config.xml configuration file on the Jenkins master where it could be viewed by users with access to the master file system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_azure_ad_plugin0.3.3 and earlier
▶NVDjenkins/azure_ad0.3.3

🔴Vulnerability Details

3
OSV
Jenkins Azure AD Plugin stored the client secret unencrypted↗2022-05-24
▶
GHSA
Jenkins Azure AD Plugin stored the client secret unencrypted↗2022-05-24
▶
CVEList
CVE-2019-10318: Jenkins Azure AD Plugin 0↗2019-04-30
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2019-04-30↗2019-04-30
▶