CVE-2019-10451

CWE-312 — Cleartext Storage of Sensitive Info5 documents5 sources

Severity

4.3MEDIUM

EPSS

0.0%

top 93.90%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Soasta Cloudtest Jenkins Project Jenkins Soasta Cloudtest Plugin

Timeline

PublishedOct 16

Latest updateMay 24

Description

Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5jenkins_project/jenkins_soasta_cloudtest_plugin2.25 and earlier

▶NVDjenkins/soasta_cloudtest2.25

▶Mavencom.soasta.jenkins:cloudtest2.25

🔴Vulnerability Details

OSV

Jenkins SOASTA CloudTest Plugin stores API token in plain text↗2022-05-24

▶

GHSA

Jenkins SOASTA CloudTest Plugin stores API token in plain text↗2022-05-24

▶

CVEList

CVE-2019-10451: Jenkins SOASTA CloudTest Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by user↗2019-10-16

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2019-10-16↗2019-10-16

▶