CVE-2019-10461

CWE-522 — Insufficiently Protected Credentials5 documents5 sources
Severity
7.8HIGH
EPSS
0.0%
top 98.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Jenkins Dynatrace Application MonitoringJenkins Project Jenkins Dynatrace Application Monitoring Plugin
Timeline
PublishedOct 23
Latest updateMay 24

Description

Jenkins Dynatrace Application Monitoring Plugin 2.1.3 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

🔴Vulnerability Details

3
OSV
Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials↗2022-05-24
▶
GHSA
Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials↗2022-05-24
▶
CVEList
CVE-2019-10461: Jenkins Dynatrace Application Monitoring Plugin 2↗2019-10-23
▶

📋Vendor Advisories

1
Jenkins
Jenkins Security Advisory 2019-10-23↗2019-10-23
▶
CVE-2019-10461 (HIGH CVSS 7.8) | Jenkins Dynatrace Application Monit | cvebase.io