CVE-2019-10453

CWE-312 — Cleartext Storage of Sensitive Info5 documents5 sources

Severity

7.8HIGH

EPSS

0.0%

top 98.70%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Jenkins Delphix Jenkins Project Jenkins Delphix Plugin

Timeline

PublishedOct 16

Latest updateMay 24

Description

Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶Mavenorg.jenkins-ci.plugins:delphix2.0.4

▶CVEListV5jenkins_project/jenkins_delphix_plugin2.0.4 and earlier

▶NVDjenkins/delphix2.0.4

🔴Vulnerability Details

OSV

Jenkins Delphix Plugin vulnerable to Cleartext credential storage↗2022-05-24

▶

GHSA

Jenkins Delphix Plugin vulnerable to Cleartext credential storage↗2022-05-24

▶

CVEList

CVE-2019-10453: Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with ac↗2019-10-16

▶

📋Vendor Advisories

Jenkins

Jenkins Security Advisory 2019-10-16↗2019-10-16

▶